Attack-Resilient Image Watermarking Using Stable Diffusion
Authors: Lijun Zhang
Xiao Liu
Antoni Viros i Martin
Cindy Xiong Bearfield
Yuriy Brun
Hui Guan
Venue: NeurIPS 2024 poster (2024)
Keywords: Computer vision
Generative AI
Image Watermarking
Primary area: diffusion_based_models

Abstract: Watermarking images is critical for tracking image provenance and proving ownership. With the advent of generative models, such as stable diffusion, that can create fake but realistic images, watermarking has become particularly important to make human-created images reliably identifiable. Unfortunately, the very same stable diffusion technology can remove watermarks injected using existing methods.
To address this problem, we present ZoDiac, which uses a pre-trained stable diffusion model to inject a watermark into the trainable latent space, resulting in watermarks that can be reliably detected in the latent vector even when attacked. We evaluate ZoDiac on three benchmarks, MS-COCO, DiffusionDB, and WikiArt, and find that ZoDiac is robust against state-of-the-art watermark attacks, with a watermark detection rate above 98% and a false positive rate below 6.4%, outperforming state-of-the-art watermarking methods. We hypothesize that the reciprocating denoising process in diffusion models may inherently enhance the robustness of the watermark when faced with strong attacks and validate the hypothesis. Our research demonstrates that stable diffusion is a promising approach to robust watermarking, able to withstand even stable-diffusion-based attack methods. ZoDiac is open-sourced and available at https://github.com/zhanglijun95/ZoDiac.

Attack Image Watermarking Using Stable Diffusion
Lijun Zhang University of Massachusetts Amherst, MA 01003-9264 1i Lijunzhang@cs. umass. edu
Xiao Liu University of Massachusetts Amherst, MA 01003-9264 xiaoliu1990@umase edu
Antoni Viros Martin IBM Watson Yorktown Heights, NY 10598 aviros@ibm com
Cindy Xiong Bearfield
Yuriy Brun University of Massachusetts Amherst, MA 01003-9264 brunêcs. umass. edu
Hui Guan
Georgia Institute of Technology
University of Massachusetts Amherst, MA 01003-9264 hui griggunncs.... umass edu
Atlanta, GA 30332 cxiong@gatech.edt edu
Abstract
Watermarking images is critical for tracking image provenance and proving owner- ship. With the advent of generative models, such as stable diffusion, that can create fake but realistic images, watermarking has become particularly important to make numan-creeted images reliably identifiable. Unfortunately, the very same stable remove watermarks injected using existing methods. To
diffusion technology address this problem, we present ZoDiac, which uses a pre-trained stable diffusion model to inject watermark into the trainable latent space, resulting in watermarks that can be reliably detected in the latent vector even when attacked. We evaluate ZoDiac three benchmarks, MS-COCO, DiffusionDB, and WikiArt, and find that ZoDiac is robust against state-of-the-arr watermark attacks, with a watermark detection rate above 98% and false positive rate below 6.4%, outperforming state-of-the-art watermarking methods. We hypothesize that the reciprocating denoising process in diffusion models may inherently enhance the robustness of the watermark when faced with strong attacks and validate the hypothesis. Our research demonstrates that stable diffusion a promising approach robust water- marking, able to withstand even stable-diffusioe bassd attack methods. ZoDiac is open-sourced and available at attttps: /:t::://ittti /ggtttb.......g com/ Baamnngijnnn///oDiii.
1 Introduction
Digital image watermarking, technique for subtly embedding information within digital images, has become increasingly crucial and beneficial in the context of content protection and authenticity verification 36
T0 4 The advance in generative AI technologies [28] 30 29], such as stable dif-
fusion, further underscores the need for watermarking solutions to distinguish between Al-generated
and human-created images.
Given an existing image, many methods have been proposed to embed a watermark that invisible and robust watermark removal attacks. Conventional watermarking strategies have employed various methods, such as embedding information in texture- -rch regions [3], manipulating the least significant bits 43, utilizing the frequency domain (2T] The emergence of deep learning has
introduced neural network (NN)-based watermarking methods [53 24 35
47 [9], which have
shown promise in achieving high invisibility and robustness against traditional attacks, such adding Gaussian noise or applying JPEG compression.
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Veremari Desectoo Rote (MDR)
Unfortunately, the recent advent of powerful image generation techniques can eircumvent ex- isting watermarking methods. The most recent work [51] shows that stable diffusion can be used in a watermark removal attack, and none of the existing watermarking techniques are robust enough to that attack. Figure I shows that the watermark detection rate (WDR) of six existing watermarking methods (DwtDet, DwtDetSvd [9]. RivaGAN [4 SSL [16]. CIN 225 StegaS- tamp B3 ) before and after the stable-diffusion- based watermark removal attack [5T] drops from 79%-100% before attack only 0%-48% after
1.0
b4fre at
0.55
0.8
0.6
0.4
622
0.2
0.0
Weaday
Stegabsarp
Watermarking Methods
Original Image
ZoDiac
Original Image
ZoDine
attack on the MS-COCO dataset 23
Figure 1: ing methods and our ZoDiac before and after the diffusion- based attack Zhao23 [51]. Two example images show that ZoDiac's 's watermarks are percep- tually invisible.
The watermark detection rate of exist-
To address the problem, propose a novel stable-diftusion-bassd watermarking frame- work called ZoDiac. ZoDiac takes as input an existing image and uses pre-trained stable dif- fusion model to inject into the image watermark that can be reliably detected even when attacked. The rationale behind ZoDiac is that a pre-trained stable diffusion maps a latent vector into an image and that more than one latent vector can be mapped to perceptually the same image. Given an existing image, ZoDiac identifies a latent vector that contains a watermark pattern and can also be mapped to the same image using pre-trained stable diffusion model. ZoDiac further allows mixes of the original image and the watermarked image to enhance image quality with a minor influence on watermark robustness. To detect watermarks, ZoDiac applies a diffusion inversion process that remaps the image to the latent vector and then detects the watermark pattern in the latent vector by statistical test. Recent trend [5 42 has used diffusion models for watermarking, but it can only encode a watermark into synthetically --gnerated images when they are being generated. By contrast, ZoDiac can watermark existing and real-world images.
ZoDiac has two distinctive features that make it robust and effective. First, ZoDiac injects watermarks in the latent space that stable diffusion models operate on when sampling random noise generate synthetic images, making the watermarks both invisible and robust to even the most advanced stable- diffusion- based attack method. We hypothesize that ZoDiac exhibits strong robustness because the image generation process of the diffusion model serves as powerful attack-defense mechanism by default and empirically validate in $4.3 Second, while existing watermarking methods typically require the training of dedicated model on a representative training dataset, ZoDiac builds on top of pre-trained stable diffusion models, forgoing the consuming training process.
Our main contributions are:
ZoDiac- a novel framework for embedding invisible watermarks into existing images using pre-trained stable diffusion. To the best of our knowledge, ZoDiac is the first watermarking method that is robust to the most advanced generative Al-based watermark removal attack. Empirically Demonstrated Strong Robustness Against Watermark Attacks Our evalua- tion on images from diverse domains, MS-COCO P3 DiffusionDB [41], and WikiArt [27 datasets, shows that ZoDiac is robust against the state-of-the-art watermark attack mechanism, with watermark detection rate (i.e., true positive rate) above 98% and false positive rate below 6.4%, outperforming state-of-the-a watermarking methods. ZoDiac also maintains invisible image quality degradation, underscoring its efficacy in achieving robust watermarking with quality preservation (see examples in Figure D
Robustness Against Combined Attacks Prior watermarking method evaluations 42 focused on robustness to only a single attack at a time. We show that in a more realistic scenario, where the attacker can combine multiple attacks, ZoDiac significantly outperforms all existing methods. For example, when combining all attacks other than image rotation, ZoDiac retains a detection rate above 50% while all existing methods fail with a detection rate of 0%. Only one of the existing methods, SSL [66. is effective against rotation, but it is ineffective against other attacks. We propose method for making ZoDiac robust to rotation (above 99%), only slightly increasing its false- dalse-positive rate (from 0.4% to 3.4%) on MS- MO-COCO dataset with appropriate hyperparameter settings.
2

---

2 Preliminary and Related Work
We first introduce the image watermarking problem and then the diffusion model background necessary to understand ZoDiac. We place our work in the context of the most related research; Appendix A discusses related work in depth.
The Robust Image Watermarking Problem. Image watermarking aims to embed a predefined. detectable watermark into image while ensuring that the watermarked image is similar to the original. This similarity is usually quantified using metrics such as the Peak Signal-to-Noise Ratio (PSNR) and the Structural Similarity Index (SSIM) [4]_ Malicious attacks can attempt remove the watermark, again, without significantly changing the image. A robust image watermarking method should be able to detect the watermark even in attacked images.
Both image watermarking and watermark removal attacks have been studied extensively. The development of deep neural networks (DNN) resulted in advanced bearning-base watermarking approaches, such as RivaGAN [48). StegaStamp (35), and SSI. [T5]. These methods train a dedicated DNN model large-scale representative image datasets to watermark images. Mcanwhile, advances in generative Al techniques have produced new attacks based on Variational AutoEncoders 12 and Stable Diffusion [29]. None of the existing watermarking approaches are sufficiently robust to these advanced diffusion- based attacks.
Diffusion Models and DDIM Inversion. Diffusion models [1], which both the most sophisticated attacks and our approach build on, are a class of generative Al models that generate high-resolution images. To explain diffusion models, we first explain the forward diffusion process, in which data point sampled from a real data distribution Ip ~ q(x) is gradually converted into noisy representation øT through 7 steps of progressive Gaussian noise addition. This transformation yields rr as an isotropic Gaussian noise, i.c., DT ~ (0, Specifically, a direct generation of xy from xo is:
Tt 2, + v1 - OtE,
where āg = -I 30). B, E (0, 1) is the scheduled noise variance that controls the step size, and I),
Diffusion models reverse this forward process, learning to retrieve the original image zo from the noise ZT by estimating the noise at each step and iteratively performing denoising. The Denoising Diffusion Implicit Model (DDIM) 333 is a prominent denoising method, known for its efficiency and deterministic output. Formally, for each denoising step f, a learned noise predictor ey estimates the noise eø (zz) added to zo, leading to an approximate of zp. Then DDIM reintroduces ep (zx)) to determine 21-1:
St v (m ) (+/1-an-1c00mm)
01-1
Vā
In this way, DDIM could deterministically recover the same image zo from the specified noise xT- DDIM also enables inversion mechanism [14] that can reconstruct the noise xy from an image zg- DDIM inversion adheres to the forward diffusion process in Eq. (I. substituting & with eg (x²) at each timestep.
We denote the denoising process, that is, the image generation process as G and its inversion as G'. A stable diffusion model [29] operates in the latent space. We use Zr and Zo in the latent space to represent the noise 2т and the image 2i respectively. A pre-trained Variational Autoencoder (VAE) carries out the transformation between the noise Ir and its latent vector Zr (and also the image zo and its representation Zo). Throughout this paper, we refer to Zr as the latent vector.
3 The ZoDiac Watermarking Framework
This section introduces ZoDiac, our novel watermarking technique that uses pre-trained stable diffusion models to achieve watermark invisibility and strong robustness to attacks. The core idea is to learn latent vector that encodes a pre-defined watermark within its Fourier space, and can be mapped by pre-trained stable diffusion models into image closely resembling the original.
3

---

Watermark Embedding
1. Latent Vector Initialization
DDIM Inversion 5
Trainable Z
Frozen Unconditioned Stable Diffusion
Reconstruction
Loss C
3. Aduptivve Image Enhanneneen
VAE Decoder
IFFT
2. Watemaar Encoding
Denoising U-Net
7
Back proopppppttionn
Inference Mode
Image Generation g
Watermark Detection
DDIM Inversion G FFT
Statistical
Using Non-cental X
Distriburion
Figure 2: Overview of ZoDiac with watermark embedding and detection phases. There are three major steps the embedding phase: 1) latent vector initialization, 2) watermark encoding, and 3) adaptive image enhancement, In the detection phase, the watermark is decoded by performing DDIM inversion, Fourier transformation, and statistical testing.
3.1 Overview of ZoDiac
Figure 2 iillustrates both the watermark embedding and detection phases the ZoDiac framework. We first explain the high-level idea, and then $3.2 and 3.3 detail each step.
Watermark Embedding. Watermark embedding consists of three main steps, latent vector initializa- tion, watermark encoding. and adaptive image enhancement. Algorithm listts the pseudocode for watermark embedding.
The original image zo first undergoes a DDIM inversion process identify its latent vector Zr (Latent Vector Initialization, Line 1, $3.2.11 I.. Zo- Diac then encodes watermark in the latent vector Zr and trains the watermarked latent vector such that pre-trained stable diffusion model can use it to generate a watermarked im- age similar the original image (Watermark Encoding. Lines 2-5, $32.22). To encode the watermark into Zr, ZoDiac converts Zr to the Fourier space, encodes given watermark W. and then transforms it back the spatial domain prior to being fed into the diffusion model. Zo- Diac preserves the visual similarity between the generated image dn and the original image by optimizing the latent vector via carefully de- signed reconstruction loss. The diffusion model remains frozen and operates in inference mode during the optimization. The gradient flow dur- ing backpropagation is indicated by the dashed red arrows in Figure After image generation, ZoDiac mixes the watermarked image 2, with the original one To to further enhance image quality (Adaptive Image Enhancement, Lines 6-7, $3.2.3).
Algorithm 1 ZoDiac- Watermarking
Require: original image øo. watermark W Require: pre-trained diffusion model G,
and its inversion g'
Require: diffusion steps T, latent update steps N
Require: SSIM threshold s*
Ensure: watermarked image 2o 1: ZT + G'(xo)
2: for to N do
3: So + G(Zr e W)
4: Take gradient descent on Vz, C(ro, ft)
(Eq. (6))
5: end for
6: To So + 7 50) (Eq.
7: Search 7 [0, 1] s.t. S 2o) 2 8" (Fq.
8))
8: return Zo
Watermark Detection. Watermark detection detects watermarks. ZoDiac first reconstructs the latent vector of the image under inspection via DDIM inversion, transforms the latent vector into the Fourier space, and then conducts a statistical test to detect potential watermark ($ ($3.3..

---

3.2 Watermark Embedding
3.2.1 Latent Vector Initialization
Finding good initialization for the latent vector Zy allows stable diffusion model to reproduce the original image To rapidly, and thus critical reducing the time spent on optimizing that latent vector. ZoDiac employs DDIM inversion to initialize the latent vector Zr ('(o)), from which DDIM can then remap to the original image. Empirically, we find that using a randomly initialized latent vector can require hundreds of iterations when remapping, while using an initial latent vector from DDIM inversion converges in dozens of iterations while achieving higher image quality (see details in Appendix B.1.
3.2.2
Watermark Encoding
The watermark encoding step aims to encode a watermark into an image with minimal impact on its visual quality. ZoDiac injects the watermark into the Fourier Space of the initialized latent vector from 43.2.T] and then optimizes the watermarked latent vector to ensure that can used synthesize an image resembling the original. Our fundamental insights are two-fold: (1) injecting watermarks into the latent space of images can effectively improve the watermark robustness thanks to the potential attack-defense capability provided by the diffusion process (see $4.3); (2) injecting watermarks into the Fourier representation of a latent vector helps preserve the quality of the watermarked image (see Appendix B.7).
Watermark Injection. ZoDiac injects a concentric ring-like like watermark into the Fourier space of the latent vector, leading to circularly symmetric watermark embedding in the low-frequency domain. Such pattern is proved to be resistant to geometric transformations and common image distortions 32 42).
ZoDiac assumes that elements of watermark W are generated by randomly sampling from complex Gaussian distribution, noted as CO((0, 1). Elements that are of the same distance to the center of the latent vector have the same value, making the watermark "ring-like", Formally, let F(ZT) E Cch be the Fourier transformed latent vector, where ch is the number of channels, and w and h the width and height. Let p = (i, be a coordinate, c (h/2, w/2) be the latent vector's 's center, and d(p, e) be the Euclidean distance from a coordinate to the center. Each element in the watermark W E Cwxh is:
W p d(pp.c)] where w[d(p.c) CN
ZoDiac also needs binary mask that indicates the location where the watermark will be applied. Mathematically, let M E {0, 1x be a binary mask with a predefined radius d". Each item in the mask M is
[I. Mp = -0,
if d(p, c) s d"; otherwise.
Finally, the watermark W is applied to the Fourier-transformed latent vector F(Zz) with the binary mask M,
F(Zr) :)= ( F(Zr)ic, W,
(5)
where ic is the watermark injecting channel and @ denotes the element- wise product. We denote the latent vector after watermarking as Zr @ W.
Latent Vector Optimization. ZoDiac then seeks to find a latent vector Zr such that, when being watermarked by W and then processed by the denoising process G, generates image ào that is the most similar to the original image zo. To solve the optimization problem, we design a reconstruction loss C that allows ZoDiac iteratively refine Zr via standard backpropagation:
= C2 20) + C,o, 20) + XTo &o),
(6)
where in GZZ + W), La is the Fuclidean distance, L, represents the SSIM loss [50] L. corresponds to the Watson- VGG perceptual loss [12, and X, Xp are weighting coefficients. These coefficients are set to balance the scale of each loss component.
5

---

3.2.3 Adaptive Image Enhancement
Adaptive image enhancement aims to improve the visual quality of the image to generated from the watermark encoding step. To do this, adaptively mixes P. with the original image zg such that the mixed image can meet desired image quality threshold. Mathematically, the mixed image To is:
To So + 7x00 - in),
(7)
where 7 E [0, 1] is a modulating factor. A higher 7y improves image quality at the cost of potential watermark diminishing. Adaptive image enhancement automatically identifies the smallest y that results in desired image quality through binary search. It optimizes the following objective:
min y, S.L. S mo) 8
(8)
where s" is the desired image quality and S is image similarity metric. We use the SSIM metric by default.
3.3 Watermark Detection
In the watermark detection phase, our primary objective is to verify whether given image contains watermark W. The detection process starts with transforming zo y (g" (xn))[-1,;: E C representing the last channel of the Fourier transformed latent vector. It then detects the presence of W in y via statistical test procedure. The statistical test computes a p-value, an interpretable statistical metric that quantifies the likelihood of the observed watermark manifesting in natural image by random chance. watermark is considered detected when the computed p-value falls below chosen threshold.
To compute the p-value, we first define the null hypothesis as Ho : y NN Ic), is estimated for each image from the variance of masked by the circular binary mask M, i.e., 2 MM {M @ y)?. This is because the DDIM inversion g' maps any test image 2g into a Gaussian distribution 31], and the Fourier transformation a Gaussian distribution remains Gaussian.
Ic), where o²
To test this hypothesis, we define a distance score rj that measures the disparity between W and y in the area defined by the binary mask M:
02 [ W - WW-Moy y
Under Ho, 1) follows non-central chi- chi-squared distribution (26), characterized by Σ M degrees of freedom and non-centrality parameter À + (MM w)?, An image is classified as watermarked if the value of is too small to occur by random chance. The probability of observing value no larger than 1), i.e., the p-value, derived from the cumulative distribution function of the non-central chi-squared distribution. Non-watermarked images will exhibit higher p-values, while watermarked images yield lower values, indicating a successful rejection of Ho and confirming the watermark's presence. In practice, treat (1 p)-value the likelihood of watermark presence and set up detection threshold p" to determine the watermark presence An image with (1 -p) > p² is considered to be watermarked.
4 Empirical Evaluation
This section evaluates ZoDiac's efficacy using a diverse domain of images including real photographs, Al- Al-generated content, and visual artwork.
4.1 Experimental Setup
Our evaluation uses images from three domains, photographs, Al-generated images, and visual artwork. For each domain, randomly sample 500 images from well-established benchmarks, including MS-COCO (23), DiffusionDB, and WikiArt.
Datasets.
ZoDiae Settings. We use the pre-trained stable diffusion model stable-diffasion-2---bmae [29 with 50 denoising steps. We show ZoDiac is compatible with other diffusion models $ $4.4 We optimize
the trainable latent vector for maximum of 100 iterations using the Adam optimizer 20 It takes

---

Table 1: Image quality in terms of PSNR, SSIM, and LPIPS, and watermark robustness in terms of Watermark Detection Rate (WDR) before and after attacks, on MS-COCO, DiffusionDB. and WikiArt datasets. We evaluate on ten individual attacks and two composite attacks: "All" that combines all the individual attacks, and "All w/o (>" that excludes the rotation attack. t and + indicate whether higher or lower values are hetter. For each attack, we highlighted in gray the techniques with the maximum WDR, and those within 2% of the maximum; ZoDiac is the only method within 2% of the maximum WDR for all attacks, except Rotation. ZoDiac dominates all methods when facing the most advanced Zhao23 attack (recall Figure D and the combined All w/o C.
Image Quality
Watcomrk Detection Raic (WDR) before and afier Attacking
Watermaninng
Pte Amack
Post Amack
Medhod
PSNK
SSIM
LPIPS
Beightness
Contrnet
G-Neise
G-Bhr
BMDD
Brnshj8
Cheng20
Zhao23
All
Rotation
DwiDe
57.85
0.790
11,003
0.0100
01000
0.687
0.156
0.000
0.030
0.000
0.000
0.000
01000
0,800
DutDesSed
58.06
11.05
0.998
1,000
0.016
0.052
0.124
0.000
0.000
RIvGGNN
0.995
0,984
1.000
1,000
0.974
0.010
0.010
0.000
0.000
4188
0.58
1,000
0.992
0.996
0,046
0.033
1,000
0.000
0.030
0.000
0.000
0.000
0.522
0.000 2
1,000
0.550
0.002
0.000
StegSump
1,000
0.958
1,000
1000
0.002
ZoPPuc
29.41
0.92
0,958
0.998
0.998
0.992
0.996
0.9%6
0.994
0.992
0.965
0.310
0.538
0.072
DwiDer
37.77
0.96
0.690
0.000
0.000
0.000
0.574
0.224
0.000
0.000
0.000
0.000
0.000
0.000
0.000
DuiDeSSd
37.84
0.97
0.02
0.958
0.088
0.083
0.812
0.983
0:956
0.656
0.014
0.90
0.116
0.000
0.00
0.000
RovGAN
40.60
0.93
0.04
0.974
0.932
0.932
0.898
0.958
0,966
0.858
0.038
0.001
0.024
0.000
0.000
0.000
SSL
41.84
0.98
0.06
0.998
0.590
0.995
0.040
0.030
1.000
0.000
0.000
0.000
0.000
0.000
0.298
0.000
CIN
39.99
0.98
0.00
1.000
1.000
1,000
0.942
0.908
0.998
0.624
0.682
0.080
0.198
0.002
0212
0.000
StegaStamp
28.51
0.90
0.13
1.000
0.995
0.998
1:000
0.908
0.998
1.000
0.996
0.988
0.302
0.002
0.000
0.000
ZoDiue
29:18
0.92
1,000
0.995
0.995
0.99%
0.953
1,000
0.994
0992
0.548
0.558
0.086
DWILAT
35.34
0UT
0.22
0.754
10003
00100
0.000
0.354
0.230
01000
0100
0000
02000
01000
1000
00000
DuiDesSe
59.14
0.98
0.02
1,000
0.995
0.094
0.688
1.000
1,000
0.668
0.03
0.72
0.116
0.000
0.003
0.000
RivaGN
40.44
0.98
0.05
1.000
0.995
1.000
0.950
1,000
1.000
0.992
0.10
0.24
0.024
0.000
0.003
0.000
SSL
41.81
0.99
0.06
1.000
0.988
0,953
0.062
0.138
1.000
0.000
0.000
0.000
0.000
0.000
01932
0.000
CIN
41.92
0.98
0.02
3.0003
1.000
1.800
0.336
0.998
1.000
0.572
0.664
0.664
0.436
0.002
11223
0.000
SiegaStamp
25.45
0.91
0.34
1,000
1.000
0.998
1,000
1,000
1,000
1,000
10000
1.000
0.182
0.002
11000
0.000
ZoDrae
30.04
0.92
0.10
1.000
1.000
1.000
1,000
0.998
1,000
1,000
0.994
0.99
0.992
0.530
0.478
0.082
45.4 - 255.9s to watermark one image (details see Appendix Dj. We calibrate the weights for the SSIM loss X and the perceptual loss Ap to 0.1 and 0.01, respectively, to balance the scales of the various loss components. We set the watermark injecting channel ic to be the last channel of the latent representation and the watermark radius d' to 10. To balance the image quality and detectability of the watermark, we set the SSIM threshold s* to 0.92 and the detection threshold p" to 0.9, except where explicitly noted otherwise. We evaluate other hyperparameter settings in the ablation study (see $4.4 and Appendix D)
Watermarking Baselines. We compare ZoDiac to six watermarking methods.
Traditional Methods: Two conventional techniques, DwtDet and DwtDetSvd 99 utilize fre- quency decomposition. DwtDetSvd has been used to watermark stable diffusion models (29).
[48 is a pre-trained GAN-based model incorporating Praining-Based Methods: RivaGAN
an attention mechanism. SSL [16] is latent-space saaeb- watermarking method that uses self- supervised learning for network pre-training CIN (25) combines invertible and non-invertible mechanisms to achieve high imperceptibility and robustness against strong noise attacks. StegaS- tamp 35 applies adversarial training and integrates both CNN and spatial transformer techniques.
Considering the above methods inject bitstrings as the watermark, we use 32-bit messages for DwtDet, Dwt RivaGAN, SSL, and CIN, and 96-bit messages for StegaStamp. Detection thresholds were set to reject the null hypothesis (i.e., Ho: the image has no watermark) with < 0.01, requiring correct detection of 24/ 24/32 and 61 /96 bits for the respective methods form fair comparison (51)
Watermark Attack Methods. We evaluate ZoDiac's ' robustness against a comprehensive set of attacks used in recent watermarking evaluations M1 The set of attacks employed includes:
Adjustments in brightness or contrast with factor of 0.5.
JPEG compression with quality setting of 50.
Image rotation by 90 degrees.
Addition of Gaussian noise with std of 0.05.
Gaussian blur with a kernel size of 5 and std of
. BM3D denoising algorithm with std of 0.1.
VA b-baded image compression models, B8shj18 (2 and Cheng20 [) with a quality level of 3.
A stable ifflusion-base image regeneration model, Zhao23 [5]] with 60 denoising steps.
7

---

Since the attack strength tuned by the hyper- parameters of different attack methods will influence the presence and detection of the injected watermark, we evaluate the effectiveness of ZoDiac under other settings in the ablation study (see $4.4 and Appendix Bp. Besides, unlike prior work, we go deeper and evaluate against the composite attack that combines all the aforementioned attacks (named "All") and variant without rotation (named "All w/o O*).
We also examine the robustness of ZoDiac under pipeline-aware attack, where the attacker has partial or full knowledge of our watermarking method, in Appendix C.2 Our results confirm the robustness of ZoDi in the face of partial knowledge attacks and underscore the critical importance of safeguarding the model weights and watermark configurations.
Evaluation Metries. We evaluate the quality of the watermarked image (2) compared to the original image (1)) using three metrics: Peak Signal-to-Noise Ratio (PSNR) T) = 10 log (MSE(a F)),
Structural Similarity Index (SSIM) 40) with range (0, 1]. and LPIPS 4 that measures perceptual similarity. For PSNR and SSIM, larger values correspond to higher image similarity: for LPIPS, lower values do. To assess watermark robustness, we use the Watermark Detection Rate (WDR) for watermarked images, which is the same as True Positive Rate (TPR), and False Positive Rate (FPR) for won-raatradreed images. Both WDR and FPR range from 0 to 1. We expect achieve high WDR and low FPR.
4.2 Results
Table D reports the watermarked image quality and WDR before and after attacks for ZoDiac and baselines.
Image Quality. ZoDiac achieves satisfactory image perceptual similarity. as defined by 7 and 34], of approximately 30dB PSNR and 0.92 SSIM. ZoDiac's ' image quality outperforms the previously most robust watermarking method, StegaStamp. Figure II in Appendix [ illustrates the visually imperceptible effect of ZoDiac's and other methods' watermarks. $4.4 examines how increasing ZoDiac's SSIM threshold can further improve image quality, trading off WDR.
Watermark Robustness. ZoDiac consistently exhibits high detection rates, within 2% of the maximum WDR, against watermark removal algorithms as highlighted by the gray cells (except for the Rotation attack). Traditional approaches, such DwtDet and DwiDetSvd, consistently fail with brightness and contrast changes, rotation, and advanced generated-Al-based attacks. RivaGAN and SSL fail for advanced attacks, B8shj18, Cheng20, and Zhao23. StegaStamp, despite being robust across most attacks, fails for rotation and demonstrates significantly diminished detection rates under the diffusion model-based attack Zhao23. When facing the composite attack excluding rotation ("All w/o O' column), ZoDiac maintains a detection rate of about 0.5, while all baselines fail, with a WDR close to O. Appendix B.8 provides more discussions on composite attacks.
The exception of rotation noteworthy. All methods, apart from SSL which incorporates rotation during training, fail for rotational disturbances. In ZoDiac, this limitation stems from the non-rotation- invariant nature the DDIM inversion process; the latent representation derived from an image and its rotated version differ significantly. However, rotation is not invisible attack and its effects are readily reversible, allowing users to manually correct image orientation to facilitate watermark detection. Appendix C.I presents an extended discussion overcoming rotational attacks.
4.3
Why ZoDiac is Attack Resilient
Recall that the image generation process is an iterative algorithm that progresses from FT to zo. involving the prediction of an approximate xo at each step and the subsequent addition of noise to obtain the noisy input for the next step. We hypothesize that this reciprocating denoising process may inherently enhance the robustness of the watermark when faced with strong attacks. To validate the hypothesis, experiment with different denoising steps when reconstructing the watermarked image on the MS-COCO dataset. In addition to the commonly-use 50 denoising steps, we further evaluate denoising steps of 10, 1, and even O, where 0 means utilizing only the well-trained image autoencoder in the diffusion model without the diffusion process.
Table 2 reports the watermarked image quality in terms of PSNR when setting the SSIM threshold x* 0.92 and the robustness when subjected three representative attacks. Appendix B.2 contains the full table with all attacks. We make two observations. First, the number of denoising steps
8

---

Table 2: The effects of varying denoising steps on image quality (PSNR) and watermark detec- tion rate (WDR). The denoising step of 0 means utilizing only the image autoencoder in the diffu- sion model without the diffusion process.
Table 3: The effects of varying detection thresh-
olds p² E {0.90, 0.95, 0.99} on watermark de- tection rate (WDR) and false positive rate (FPR). 1 and L. indicate whether higher or lower values are better.
Denoising PSNRT Steps
WDR hefore and after attack
Detection Threshold p*
WDR before and after allack
FPR.
Pre-Attack
Post-Altack
Pre-Anack
Post-Attack
Rolation
Zhao23
Rotation
Zhao23
w/o
50
29.41
0.998
0.538
0,988
0.510
0.90
0.062
0.998
0.538
0,988
0.510
10
29.51
0.996
0.534
0.976
0.502
0.95
0.030
0.998
0.974
0.372
28.67
0.992
0.532
0.97
0.498
0.99
0.004
0.992
0.106
0.938
0.166
29.09
0.712
0.002
Trade-off- Attacked Bisshj88
Trade-off- Allacked by Cheng20
Watermark Detection Rate (WDR)
1.0-
1.04
1.0
Watemark ROOUTTINE
G.B-
Peftic
0.6-
StegaStemp
6.6-
Shagalhamp
0.8
Owildet
Destcct
0.4-
RivaDAN
RivaDAN
0.6
2-2-
0.2
0.
C.0
0.85
0.20
0.85
0.90
0.95
by
None
Watermak hooustinss AWOR
Trade-off by Zhao23
Trade-off- Attacked Rotation
0.2-
2-1-base
Zhao23
--- v1-4
0.8
Pedlar
G.B.
0.0
All wio Rotation
xi-base-1.0
D.G-
StegaGramp Owidst
C.6-
C.6-
0.80
0.85
0.90
0.95
0.4.
Stamo
Watermarked Image Quality in SSIM
RIvaGAN
SS1
0-2
0.0
C.
0.30
0.05
0.30
0.35
0.20
0.25
0.90
0.95
Wateraa Imge Quality SS/N
Watermaa knd Image Qualitt in SSIN
Figure 3: The trade-off between the watermarked image quality (SSIM) and the watermark detection rate (WDR) on MS-COCO dataset. The image quality is controlled by SSIM threshold s" [0.8, 0.98] in increments of 0.03 and the robustness is evaluated post-attack with four advanced attack methods.
Figure 4: ZoDiac exhibits comparable re- sults when using different pre-trained sta- ble diffusion models, caale-diffusion-2 I-base, stable-diffusion-vl- -4, and stable- diffusion-xl-base- 1.0. Colors represent at- tacks; "None" represents no attack.
do not significantly influence the watermarking performance. Regardless of the attack methods employed, ZoDiac exhibits consistently high WDR while maintaining similar image quality with different denoising steps. Second, even when reduced to single denoising step, ZoDiac significantly outperforms the variant without the diffusion process (i.e., when the denoising step is 0) in terms of watermark robustness, thereby verifying the hypothesis that the diffusion model contributes substantially to the robustness of the embedded watermark.
4.4 Ablation Study
Varying the SSIM Threshold s". While a high image quality threshold s* can yield an image with negligible quality loss, it conversely raises the risk of watermark elimination. This study explores the impact of varying s" on image quality and watermark robustness. Figure
the trade-off curves on the MS-COCO dataset, subject to four advanced attack methods, by adjusting SSIM thresholds s E [0.8, 0.98] in increments of 0.03. Appendix B.3 reports results for eight other attacks and two other datasets. Overall, against advanced watermark removal techniques, ZoDiac consistently outperforms all baseline methods in terms of robustness. Although the adaptive image enhancement step can also enhance the watermarked image quality of StegaStamp, the most robust baseline method, it causes a significant decline in its watermark robustness, as shown by the pink line in Figure 3 StegaStamp injects watermarks in the image space, making it more sensitive to the enhancement. By contrast, ZoDiac injects watermarks in the latent space of images, benefiting from the enhancement step and achieving balance between high image quality and watermark robustness.
Varying the Detection Threshold p'. Recall from $3.3 that an image is considered watermarked if its (I va-uue exceeds p". A larger p" imposes a stricter criterion for watermark detection, reducing the

---

Table 4: The PSNR of attacked watermarked images compared to those without being attacked and the WDR of ZoDiac and StegaStamp under different strengths from 0.2 to 1.0 (i.e., no attack) of the Brightness attack (left) and the Contrast (right) attack.
Detection Threshold
WDR under Brightness Factor of
Detection Threshold
WDR under Contrast Factor of
FPR
FPR
0.2
0.4
0.6
0.8
1.0
0.2
0.4
0.6
0.8
1.0
PSNR
11.41
14.56
27.95
33.58
100.0
PSNR
14.54
23.03
30.56
36.57
100.0
StegaStamp
61/96
0,852
0.988
1.0
1.0
StegnStamp
61/96
0.056
0.730
0.98
1,0
1.0
StegnStamp
60/6
0.094
0.890
1,0
1.0
1.0
1.0
StegnStamp
60/96
0.094 0.768
0.998
1.0
1,0
1.0
ZoDiac p 0.95
0.032
0,994
0.994
0.998
0.998
0.998
ZoDiac p. = 0.95 0.032 0.998 0,996
0,998
0.998
0,998
ZoDiag
P 0.90 0.062 0.996
0.998
0.998
0.998
0.998
ZoDiac
0.90 0.062 0,994 0.998 0,998
0.998
0.998
probability of both watermark detection for watermarked images, measured by watermark detection rate (WDR), and false detection for non-watermarked images, measured by false positive rate (FPR). Table reports the effects of detection thresholds p* E {0.90, 0.95, 0.99} on WDR and FPR before and after three representative attacks on MS-COCO dataset. Appendix [B44 contains the full table with all attacks for the three datasets and also provides the FPR of baselines for reference. The data show that p- = 0.9 maintains a high WDR and an acceptable FPR, in practice.
Varying the Backbone Models. ZoDiac is compatible with different pre-trained stable diffusion models. In this study, we extend our evaluation to the table-diffusion- -il-tssiooo--l44a- and muble-diffusion -x-- base-1.0 (in addition watermarked image quality and the watermark detection rate without attack as well as with three representative attacks, Rotation, Zhao23, and All w/o O. Appendix [B.5] shows additional results addressing other attacks. The data shows consistent performance (WDR and image quality in SSIM) between the two models, as indicated by the almost overlapped solid and dashed lines, suggesting that ZoDiac can seamlessly integrate with other pre-trained stable diffusion models, maintaining its state-of-the-ar efficiency, regardless of the backbone model employed.
ttable-diffusions --bases)). F shows the trade-off curves between the
Varying the Attack Strength. We also compare ZoDiac with the strongest bascline StegaStamp under different Syper-parameter settings of the attack methods, in terms of WDR under different FPR levels. Table repoort the image quality in terms of PSNR and the watermarking robustness when we adjust the Brightness and Contrast attacks with factor of 0.2 to 1.0 following WAVES []]. As the adjustment factors for brightness and contrast decrease from 0.9 to 0.2, the PSNR of the attacked watermarked images drops significantly-
37.79 to 11 11.41 for brightness and from 38.57 14.54 for contrast. Despite this degradation, ZoDiac consistently maintains a WDR above 0.99 across all scenarios. Even extreme settings, where PSNRs fall to 11.41 for brightness and 14.54 for contrast, ZoDiac significantly outperforms StegaStamp, achieving higher WDR and lower FPR. This clearly demonstrates ZoDiac robustness even under severe quality degradation. Appendix B.6 injlude additional results when tuning other attacks.
5 Contributions
We have presented ZoDiac, robust watermarking framework based on pre-trained stable diffusion models. ZoDiac hides watermarks within the trainable latent space of a pre-trained stable diffusion model, enhancing watermark robustness while preserving the perceptual quality of the watermarked images. An extensive evaluation across three datasets of photographs, Al-generated images, and art demonstrates ZoDiac's effectiveness in achieving both invisibility and robustness to an array of watermark removal attacks. In particular, ZoDiac is robust to advanced generative-Al-bart removal methods and composite attacks, while prior watermarking methods fail in these scenarios. This robustness, coupled with the ability to achieve high-quality watermarked images, positions ZoDiac as a significant advancement in the field of image watermarking. ZoDiac focuses on zero-bit watermarking [17], only hiding and detecting a mark. ZoDiac is constrained to adhere to a Gaussian distribution in the latent vector of the diffusion model, but future work will explore encoding meaningful information, such as a message, in the watermark while preserving ZoDiac's robustness.
Acknowledgments and Disclosure of Funding
This work supported in part by the National Science Foundation under grants no. CCF-2210243, DMS-2220211. CNS-2224054, CNS-233851 and CNS-2312396
10

---

References
[1] Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldsteim, al. Waves: Benchmarking the robustness of image watermarks. In Forty-first International Conference on Machine Learning, 2024.
[2] Johannes Ballé, David Minnen, Saurabh Singh, Sung Hwang. and Nick Johnston. Variational image compression with a scale hyperprior. arXiv preprint (Tt1:1802.014300 2018.
[3] Walter Bender, Daniel Gruhl, Norishige Morimoto, and Anthony Lu. Techniques data hiding, IBM systems journal, 13:33333,,,,3,,, 1996.
[4] Jeffrey Bloom, Ingemar Cox, Ton Kalker, J-PMG Linnartz, Matthew I. Miller, and C Brendan S Traw. Copy protection for dvd video. Proceedings of the IEFE, 87(7):1267-1276, 1999.
[5] Dan Bonch and James Shaw. Collusion-secure secure fingerprinting for digital data. IEEE Transactions on Information Theory, 14(5):1877-1955, 1998.
[6] Adrian Bors and loannis Pitas. Image watermarking using det domain constraints. In Proceedings of 3rd IEEE International Conference on Image Processing, volume 3, pages 231-234, IEEE, 1996.
[7] Agneet Chatterjee, Sudipta Kumar Ghosal, and Ram Sarkar. Lsb based steganography with ocr: an intelligent amalgamation. Multimedia tools and applications, 19917718)11177711111 2020.
[8] Zhengxue Cheng, Heming Sun, Masaru Takeuchi, and Jiro Katto. Learned image compression with discretized gaussian mixture likelihoods and attention modules. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pages 7939-7948. 2020.
[9] Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker, Digital watermarking and steganography. Morgan kaufmann, 2007.
[10] Scott A Craver, Nasir D Memon, Boon-Lock Yeo, and Minerva M Yeung. Can invisible watermarks resolve rightful ownerships? In Storage and Retrieval for Image and Video Databases volume 3022, pages 310-321. SPIE, 1997.
[11] Yingqian Cui, Jie Ren, Han Xu, Pengfei He, Hui Liu, Lichao Sun, and Jiliang Tang. Diffusionshield: watermark for copyright protection against generative diffusion models, arXiv preprint arXiv:2306.044 046422 2023.
[12] Steffen Czolbe, Oswin Krause, Ingemar Cox, and Christian Igel. A loss function for generative neural networks based on watson's 's perceptual model. Advances in Neural Information Processing Systems, 33:2051-2061, 2020.
[13] Kostadin Dabov, Alessandro Foi, Vladimir Katkovnik, and Karen Egiazarian. Image denoising by sparse 3-d transform-done domain collaborative filtering. IEEE Transactions on image processing, 16(8):2080 2095, 2007.
[14] Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans image synthesis. Advances in neural information processing systems, 34:8780-874 2021.
[15] Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks latent diffusion models. arXiv preprint arXiv:2303.15433 2023.
[16] Pierre Fernandez, Alexandre Sablayrolles. Teddy Furon, Hervé Jégou, and Matthijs Douze. Watermarking images self-supervised latent spaces. ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 3054-3058. IEEE, 2022.
[17] Teddy Furon. A constructive and unifying framework for zero-bit watermarking. IEFE Transactions on Information Forensics and Security, 2(2):149-166 2007.
[18] Osama Hosam. Attacking image watermarking and steganography-a survey, International Journal of Information Technology and Computer Science, 1(3):23-37, 2019.
[19] Jiangtao Huang, Ting Luo, Li Li, Gaobo Yang, Haiyong Xu, and Chin-Chen Chang. Arwgan: Attention- guided robust image watermarking model based on gan. IEEE Transactions on Instrumentation and Measurement, 2023.
[20] Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint IrXiv:1412.660 69800, 2014.

---

[21] Deepa Kundur and Dimitrios Hatzinakos. Digital watermarking using multiresolution wavelet decom- position. In Proceedings of the 1998 IELE International Conference on Acoustics, Speech and Signal Processing, ICASSP'98 (Cat. No. 98CH36181), volume S, pages 2969-2972. IEEE, 1998.
[22] Jac-Fun Lee, Young-Ho Seo, and Dong-Wook Wook Kim. Convolutional neural network-based digital image watermarking adaptive to the resolution of image and watermark. Applied Sciences, 10(19))6854, 2020.
[23] Tsung-Yi Yi Lin, Michael Maire, Serge Belongie, James Hays, Pictro Perona, Deva Ramanan, Piotr Dollár, and C Lawrenee Zitnick. Microsoft coco: Common objects in context. In Computer Vision-ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pages 740-755. Springer, 2014.
[24] Xiyang Luo, Ruohan Zhan, Huiwen Chang, Feng Yang, and Peyman Milanfar. Distortion agnostic deep watermarking. In Proceddiggs of the IEEE/CVF conference on computer vision and pattern recognition, pages 13548-13557, 2020.
[25] Rui Ma, Mengxi Guo, Yi Hou, Fan Yang, Yuan Li, Huizhu Jia, and Xiaodong Xie. Towards blind watermarking: Combining invertible and non-invertible mechanisms. In Proceedings of the 30th ACM International Conference on Multimedia, pages 1532-1542, 2022.
[26] PB Patnaik. The non-central x 2-and f-distribution and their applications. Biometrika, 36(1/2):202-25 232. 1949.
[27] Fred Phillips and Brandy Mackintosh. Wiki art gallery, inc.: A case for critical thinking. Issues in Accounting Education, 26(3):593-608, 2011.
[28] Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen, Hierarchical text-conditional image generation with clip latents. arXiv preprint arXiv:2204. 06125, 1(2)3, 2022.
[29] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björ Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and puttern recognition, pages 10684-10695, 2022.
[30] Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L. Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, al. Photorealistic text-to- image diffusion models with deep language understanding. Advances in Neural Information Processing Systems, 35:36479-36494, 2022.
[31] Jascha Sohl- Dink-Dissttin, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. In International conference on muchine learning, pages 2256-2265. PMLR, 2015.
[32] Vassilios Solachidis and Loannis Pitas. Circularly symmetric watermark embedding in 2-d dft domain. IEEE transactions on image processing, 10<11):144-1153, 2001.
[33] Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models, arXiv preprint arxiv20010.02002, 2020.
[34] Mansi S Subhedar and Vijay H Mankar. Secure image steganography using framelet transform and bidiagonal svd. Multimedia Tools and Applications, 79:1865-18888 2020.
[35] Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical photographs. In Proceedings of the IEEE/CVF conference on computer vision and puttern recognition, pages 2117-2126. 2020.
[36] Anatol Z Tirkel, GA Rankin, RM Van Schyndel, WJ Ho, NRA Mee, and Charles F Osborne. Electronic watermark. Digital Image Computing, Technology and Applications (DICTA '93), pages 666-673, 1993.
[37] Matthieu Urvoy, Dalila Goudia, and Florent Autrusseau. Perceptual dft watermarking with improved detection and robustness to geometrical distortions. IEFF Transactions on Information Forensics and Security, 9()): 97)):1008 1119 2014.
[38] Wenbo Wan, Jun Wang, Yunming Zhang, Jing Li, Hui Yu, and Jiande Sun. A comprehensive survey on robust image watermarking. Neurocoppuingg 488:226-247, 2022.
[39] Zhenting Wang, Chen Chen, Yuchen Liu, Lingjuan Lyu, Dimitris Metaxas, and Shiqing Ma. How to detect unauthorized data usages in eext-to-image diffusion models. arXiv preprint arXiv:2307.031000 03100, 2023.
12

---

[40] Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE transactions image processing. 13(4):600-612, 2004.
[41] Zijie Wang. Evan Montoya, David Munechika, Haoyang Yang. Benjamin Hoover, and Duen Horng Chau. Diffusiondb: A large-scale prompt gallery dataset for text-to-image generative models. arXiv preprint arXiv:2210.148%3 2022.
[42] Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings watermarks: Invisible fingerprints for diffusion images. Thirty-seventh Conference on Neural Information Processing Systems, 2023.
[43] Raymond B Wolfgang and Edward J Delp. watermark digital images. Proceedings of 3rd IEEE International Conference on Image Processing, volume 3, pages 219-222. IEEE, 1996.
[44] Xiang-Goo Xia, Charles Boncelet, and Gonzalo R Arce. Wavelet transform based watermark for digital images. Optics Express, (12)::97-511, 1998.
[45] Zeng, Mo Zhou, Yuan Xue, and Vishal Patel. Securing deep generative models with universal adversarial signature. arXiv preprint arXiv:2305. 16310, 2023.
[46] Kai Zhang, Wangmeng Zuo, Yunjin Chen, Deyu Meng, and Lei Zhang. Beyond gaussian denoiser: Residual learning of deep can for image denoising. IEEE transactions on image processing, 26(7):3142-
3155, 2017.
[47] Kevin Alex Zhang, Alfredo Cuesta-Infante, Lei Xu, and Kalyan Veeramachaneni. Steganogan: High capacity image steganography with gans, arXiv preprint 10X099900.00399,, 2019.
[48] Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. arXiv preprint arXiv: 1909.01285, 2019.
[49] Richard Zhang, Phillip Isola, Alexei Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features perceptual metric. In Proceedings of the IEEE conference computer vision and pattern recognition, pages 586 586-595, 2018.
[50] Hang Zhao, Orazio Gallo, Iuri Frosio, and Jan Kautz. Loss functions for image restoration with neural networks. IEEE Transactions computational imaging, 3(1):47-3 57, 2016.
[S1] Xuandong Zhao, Kexun Zhang, Yu-Xiang Wang, and Lei Li. Generative autoencoders watermark attackers: Analyses of vulnerabilities and threats. arXiv preprint arXiv:2306.01953, 2023.
[52] Yunqing Zhao, Tianyu Pang, Chao Du Xiao Yang, Ngai-Man Cheung, and Min Lin. A recipe for watermarking diffission models. arXiv preprint arXiv:2303.1013 10137, 2023.
[53] Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In Proceedings of the European conference on computer vision (ECCV), pages 657-672, 2018
13

---

A Additional Related Work
Digital Image Watermarking, Digital watermarking, particularly in the image domain, has been comeestone in computer vision for decades. Traditional methods have predominantly relied frequency decomposition techniques such as Discrete Fourier Transform (DFT) [37], Discrete Cosine Transform (DCT) [6]. Discrete
Wavelet Transform (DWT) A., or their combinations 9 These frequency-basee methods are advantagcous due to their inherent resilience to common image manipulations.
The development of deep neural networks (DNN) has introduced novel learning-basse basing watermarking approaches. HiDDeN [55] employs joint training of watermark encoder and decoder alongside noise layers that mimic image perturbations. It leverages an adversarial discriminator for enhanced visual quality and has been expanded for arbitrary image resolutions and message lengths 22 Regarding the watermark robustness, StegaStamp [35] uses differentiable image perturbations during training to improve noise resistance and incorporates a spatial transformer network for minor perspective and geometric changes. Distortion Agnostic (24) further brings robustness unforeseen transformations by introducing adversarial training. Considering the watermarking as an image generation process, RivaGAN [48). SteganoGAN [47], and ARWGAN [19] resort to generative Al, particularly Generative Adversarial Network (GAN), for enhanced performance and robustness watermarking. A comprehensive review is provided in BB With the demonstrated efficacy of diffusion models in image generation [4], our work pioneers the use of pre-trained diffusion models for robust image watermarking.
Image Watermarking Attack. Watermarking attacks are typically categorized into types 511. Destructive attacks treat the watermark as part of the image, seeking remove it through image comuuption. Common methods include altering image brightness or contrast, applying JPEG compression. introducing Gaussian noise, and so on. Constructive attacks, on the other hand, view the watermark as noise superimposed on the original image, focusing on its removal via image purification techniques such as Gaussian blur [8] BM3D [13. and learning- -ased methods like DrCNNs (6). Recently, regeneration attacks have emerged, leveraging the strengths of both destructive and constructive approaches. These attacks corrupt the image by adding Gaussian noise to its latent representation, then reconstruct it using generative models such as Variational AutoEncoders [29]. We aim to effectively counter watermark removal attacks especially advanced generative AT-based ones when watermarking given images.
2 g or Stable Diffusion
Diffusion Model Watermarking, Rapid evolution in deep generative models has led to methods capable of synthesizing high-quality, realistic images [14.. These models pose threats to society due to their potential misuse, prompting the necessity to differentiate Al-generated images from those created by humans. Recent efforts resort to watermarking the model itself, which focuses on enabling these models to automatically generate watermarked images for casier identification later. One straightforward approach is to fine-tune diffusion models with datasets containing watermarked images, leading these models to inherently produce watermarked outputs Alternatives like Stable Signature [15] focus on training a dedicated watermark decoder fine-tune only the latent decoder part of the stable diffusion model. Tree-Rings [4] takes a different route by embedding watermarks in the initial noisy latent, detectable through DDIM inversion [4] Although these methods effectively lead diffusion models to generate watermarked images, they are not equipped for watermarking existing images, functionality our approach is designed to provide.
39 12 45
B Additional Ablation Study
B.1
Effectiveness of Latent Vector Initialization
Figure compares the synthetic images at different op- timization iterations when training the latent vector ini- tialized with the vector from DDIM inversion (a) and a vector randomly sampled from the Gaussian distribution (b). The result shows the advantage of the latent vector initialization step, which achieves a higher quality image, measured by the L2 distance between the image and its original counterpart within only 20 iterations. In contrast, randomly initialized latent vector requires more than hun- dreds iterations produce similar image whose quality (L2= = 0.0036) still largely falls behind.
beee u,4, aLDiso 1e Bacal it= 20,4, 0.2055
(a) Images genorated from prepared initial latent with DDIM inversion
C.Ay 3120 If 20.1, Ly 51070 it 2011
500,, 6001
Images generated from random initial latent
Figure 5: Synthetic images along with the op- timization iterations and L2 loss values. We observe much faster convergence when (a) using the latent vector initialized from the DDIM inversion compared to (b) using ran- domly initialized latent vector.
B.2
Why ZoDiac is Attack Resilient Continued
Table completes Table from $4.3 showing the effects of different denoising steps when reconstructing the wa- termarked images on WDR under all attacks. We measure WDR on watermarked images generated with the SSIM threshold s' = 0.92. Overall, ZoDiac exhibits consistently high WDR with different denoising steps.
14

---

Table 5: The effects varying denoising steps on image quality and watermark detection rate (WDR). The denoising step of O means utilizing only the image autoencoder in the diffusion model without the diffusion process. 1 and indicate whether higher or lower values are better.
Demolsing Steps
Image Quality
Watermark Detection Rate (WDR) before and aher attack
PSNR LPIPS
Pre-Amack
Post-Attck
Brightess
Contrast
JPBG G-Noise G-Blur
BMSD
Bmshj188 Cheng20
Zhan25
01.54
0.988
20.44
0..92
0.088
0.995
0.992
0.99
0.994
0.99
0.982
0.510
0.07
10
29.51
0.92
0.08
0.595
0.998
0.994
0.992
0.990
0.996
0.994
0.985
0.984
0.976
0.502
0.534
0.068
1 25.67
0.92
0.10
0.992
0.99
0.985
0.988
0.958
0.992
0.991
0.98
0.978
0.97
0.498
0.532
0,060
0
29.09
0.92
0.08
0.342
0.074
0.938
0.888
0.9
0.838
0.744
0.738
0.7
0.712
0.002
0.236
0,000
demonstrating that different denoising steps not influence the watermark robustness. In the meanwhile, when the denoising step becomes O, the robustness drops significantly, which verifies the hypothesis that the diffusion process contributes substantially to the robustness of the embedded watermark.
B.3 Varying the SSIM Threshold s" Continued
Recall from (3.2.3 that the final watermarked image de is derived by blending the raw watermarked image do with the original image to meet the desired image quality, specified by SSIM threshold s". While setting high threshold for image quality s* can result in minimal loss of image quality, it simultancously decreases the likelihood of accurate watermark detection. Building Figure from $4.4 explore the impact varying s* values on the tradc-off between image quality and watermark robustness on the full set of attacks and datasets. Figures 66 [7, and show the trade-off curves on the MS-COCO, DiffusionDB, and WikiArt datasets, respectively. The x-axes show the watermarked image quality in SSIM and the y-axis shows the watermark detection rate, subject twelve various attack scenarios. ZoDiac's image quality is controlled by SSIM thresholds s* E [0.8, 0.98) in increments 0.03.
4.4 summarized two main observations, which are confirmed by these further experiments: First, ZoDiac produces watermark robustness that on par with or surpasses that of the existing methods with similar image quality. For instance, when brightness or contrast changes, ZoDiac's WDR approximates that of RivaGAN and SSL. Notably, against more advanced watermark removal techniques, Figures and ZoDiac consistently outperforms all baseline methods in terms of robustness. Second, although adaptive image enhancement can also enhance watermarked image quality of StegaStamp, robust baseline method, this approach markedly reduces its watermark robustness, as indicated by the pink lines in Figures 6 7 and [ This decrease in robustness occurs because StegaStamp embeds watermarks directly in the image space, rendering more vulnerable the proposed image quality enhancements. By contrast, ZoDiac injects watermarks in the latent space of images, allowing it benefit from the enhancement step achicving balance between good image quality and high watermark robustness.
depicted in the final row of
most
15

---

Tracevoff wie Attack
Trade-off Attacced by Brightresed
Trade-off Atiaceed by Contrast.
Tradeoof- Attacked
-ittcoof-AAtacieed by JPBG
Miy Auee
Outictiedd
02
0.2-
1RR RESAIT 1004 waw.er--ibiaa SEEETTI RED Nuturuuk
wte Wore
0.50
0.00
0.1g
9.45
2:30
8.75
0.60 0.80
0.30
0.1o
c.50
0.30
6:35
image
image
Trade off Attacked Rotation
Trade off Attacked Noise
Trade off Attacked by G Blur
Trade off Attacked BH3D
1.
2.0
2.0
Sepsiars
Seegelaam Indbetiv
Oytirted
Watever
Mara THEE TOMAn TOR3 WDX Walatiee
D.c
0.80
0.80
0.90
055
9:00
0:50
0.80
0.85
0.90
0.5
0.80
2:55
0:90
6:55
vaage
Waterma image Quality
image Quality in
Water Image by SSH
Trade-oll Attacked Birshy18
Tradeoff- Atlached by Cherg20
Tadd-off- Attacieed by Zhan?3
Trddealf- Atticc bad by All wro llctation
1.c.
1--
1.0.
02
6.8
Re-
Srep
86-
Sreg
Oeticted
Oetterted
0.50 0.00
0.50
0.82
c.55
2:50
0.55
0.50
0.00
0.50
0.50
0.50
2-85 0.50
0.80
Watemarked troge Quality SSN
Watermaa Red imase Quality SSM
Watermarked Image Quality in 5004
Warermaneed Image Qual Som
Figure 6: The trade-off between the watermarked image quality in terms of SSIM and the watermark
robustness in terms of watermark detection rate (WDR) on MS-COCO dataset. The image quality is controlled by SSIM threshold s* E [0.8, 0.98] with step size of 0.03 as described in $3.2.3 and the robustness is evaluated pre-attack and post-attack with different attack methods.
Trace-off
Wotern PeAAAbio CUROR
Tradewoff
Trade-off-
Trade-off-
1.0
0.c-
0.6-
0.8
J00
C.G.
Zabisc
D.E-
0.0
Zabic
Dubiil
0.6
Dutii
0.2
Wntemaak
0.0
Watermrfac Image Quality in sSM
Wabermaneed and Image Quality in SSM
Wastamarted Image Quality in SSNN
Wattrranoed Image Dual by in 20M
Untemaa wobe
Attacked by
Noise
Attackee by
mam Resutt Rocustreg 105 Watemaa BesuEre Wan
n.c.
rees
n.e.
ne-
201
B.6-
Zoliic
0.6-
04
Dvtiit Reacie
CA--
6.4-
GA
92
222
Ne aosi
CM
CM
Watsmmahhd trage ssMv
Wuturnatted Cuality in 33M
Natamarked
Watarmaried Image S0M
Trade-oft ott Attacked by Breshy
Trade-oft Attacited by Cherg20
Trae-oot Attacked by Zheo73
Trade- oft--ttt-- Attacked by All wro Rotation
04 DE
Zel Deth
Zollec twith!
E.C.
Zoile
CA
0.4-
Dwth
No vtus
0.
8.0
0.0
635
0.90
2:45
0.05
Watermated
SQM
Wnsermareed
WWdermareed
Image SON
Figure 7: The trade-off between the watermarked image quality and the watermark robustness on DiffusionDB dataset similar to Figure 6
16

---

Attacied Brightress
Tradeofff Atlacledd by Contrast
Tradeofff by JPSC
0.8-
Pullae Dutbis Reali
Pulhus
2uliuc beetic
0.4-
Dedict
02-
2.2
6.2
Marmar wann Ge Peremmtt
EM
0.8.
CN
CM
9-5 Waturmartod Quality s30n
0. som
Watsrmerhd soM
Watsrmaked Image ScIN
Wattrmansed
Trade-off- Attacieed by Rotation
RRa TETTTNN DeN in W22 KRtamma WOSSAEEE REA
Trade-off- Attacked by G-Noise
Trade-oft- Attacked by G-Blur
Trade-off- Attacked by BM1D
200
Zollec Ewiiee
Z0lle
D4
Dutbit Sosuw
0.4-
Oediet
unnemar'
ac-
0.0.
34
Trade-oft- Attacked by Brrshy1
Trade-off Aftacheed by Cherg?0
Trad-oof- Attacited by Zhan7
Trade-atf- Aftaciied by All wea Rehation
Stepller
Steudaee Duth
Dath
bwibuiku
Man CI
C...
83
53
8.3
0.0
6.7
0.0
0.3
0.5
trage Quality
image Quality 550
Image
Image
Figure 8: The trade-off between the watermarked image quality and the watermark robustness on
WikiArt dataset similar Figure
17

---

B.4 Varying the Detection Threshold p" Continued
Table 7 completes Table 3 from $4.4 showing the ef- fects of detection thresholds p E (0.90, 0.95, 0.99) on
Table 6: The FPR for existing methods on the MS-COCC dataset.
WDR and FPR, under all attacks. We measure WDR on
watermarked images generated with the SSIM threshold s" = 0.92. The maximum WDR and WDR within 2% of the maximum are highlighted in gray. As expected, a higher p" usually corresponds to lower rates of both WDR and FPR. Specifically, under most attack conditions except Rotation and All w/o O. WDR exhibits a marginal decline when p" is increased. We further provide the FPR of existing methods on the MS-COCO dataset in Table reference. When investigating the results in Table in the main paper together with Table 6 anadd Table ( conclude that, under the FPR level, ZoDiac always achieves higher Watermark Detection Rate (WDR), demonstrating its superiority on watermark robustness.
Method DwiDet DwdDerSvd RivaGAN SSL. StegaStamp 0.036
FPR 0.052
0.018
0 0.026
0.056
Table 7: The effects of varying detection thresholds p' E {0.90, 0.95, 0.99} on watermark detection rate (WDR) and false positive rate (FPR) for all attacks. We measure WDR on watermarked images generated with SSIM threshold s* 0.92. We highlighted in gray the techniques with the maximum WDR, and those within 2% of the maximum. The data indicate that a higher y usually corresponds to slightly lower WDR.
Watermark Detection Rate (WDR) 1 before and after attack
Detection FPR Threshold
Pre-Attack
Post-Atrack
Brightness Contrast JPEG G Noise G Blur BM3D Bmshj18 Cheng20 Zhan23 All w/o O Rotation All
MS-COCO
0.90
0.062
0.998
0.998
0.998
0.992
0,996
0.996
0.994
0.992
0.986
0.988
0,510
0.538
0.072
0.95
0.030
0.998
0.998
0.992
0.996
0.996
0.994
0,986
0.978
0.974
0.376
0.028
0.99
0.004
0.992
0.990
0.990
0.978
0,984
0,988
0.988
0.980
0.954
0.938
0.166
0.106
0.000
DiffusionDB
0.90
0.050
1,000
0.998
0.998
0.994
0.998
1.000
1,000
0.994
0.992
0.988
0.548
0.558
0.086
0.95
0.018
1,000
0.998
0.996
0.994
0.994
1.000
1.000
0.992
0.988
0.952
0.418
0.356
0.028
0.99
0.004
0.998
0.992
0.99
0.982
0,950
1.000
0.994
0.974
0.984
0.902
0.174
0.130
0.006
WikiArt
0.90
0.064
1,000
1.000
1.000
1.000
0.998
1.000
1.000
0.994
0.994
0.992
0.530
0.478
0.082
0.95
0.024
1,000
1.000
0.998
0,996
1.000
0.998
0.994
0.900
0.980
0.392
0.330
0.032
0.99
0.004
1,000
1.000
1,000
0.992
0.994
1.000
0.998
0.980
0.964
0.944
0.192
0.104
0.002
B.5
Varying the Backbone Models Continued
FigureJjcopplet Figure 4 from $4.4 which includes the trade-oft off curves between image quality and watermark robustness under the individual attacks and the two composite attacks when using difterent backbone stable diffusion models, stable- bisoll--iffuiion-.o 2-1 -base, stable-dijfe sibble-dffusson- -4, and stable- diffusionn al-base-L. I.0. The figure
Without Attack
Attacked Brightness
Attacked by Contrast
Attacked by JPEG
cān
cinn Wattmartd mage Quality in 55M
Watomar aod Qualtty 5SM
Wattmmakked Quakiy in M
Watemakke Image Quality S3
Attacked by Rotation
Attacked by Noise
Attacked by G-Blur
Attacked by BMID
124
8.00 0.5
5.90
5.5
0.0 0.35
550
0.5
0.00
5.85
0.00
0.05
5.50
0.85
0.80
6.50
Wotemarie mage Qualty SSM
Watomarked Image Quality
Watemarked Image Quality SSEM
Watomanied mage Quality
Attacked by Brahil8
Attacked by Chena2o
Attacked Zhao23
Attacked by wio Rotation
VOD
0-
0.5s
in
Watermrris Qua 3SM
Watarmarkad in S5
Watermarkdd Image Quality SIMM
Watermannsd Quality S3M
Figure 9: The watermarking performance comparisons between three pre-trained stable diffusion models, stable-diffusion -iffussion--- --base,, cuble-diffusion-- v -4, and stable-difiusion -l--nn-----a---e----e The trade- off curves between the watermarked image quality and the watermark detection rate with and without attack are provided.
18

---

shows the trade-off curves between the watermarked image quality and the watermark detection rate with and without attack. Overall, the three backbone models exhibit similar watermarking performance.
B.6 Varying the Attack Strength Continued
We conducted additional experiments under various attack levels, following the settings in WAVES ①.. The experiments span multiple attack scenarios:
Tables and Adjustments in brightness or contrast with factor of 0.2 to 1.0 (i.e., the watermarked images
without being attacked).
Table 10
JPEG compression with a quality setting from to 90
Table 11
Gaussian noise with a standard deviation varying from 0.02 to 0.1
Table 12
Gaussian blur with a kernel size of 5 to 19.
Tables 13
and 14
Two VAE based image compression models, Bmshj18 and Cheng20 with quality levels of 2
to 6.
Table 15 A stable cerfusion-bbsed image regeneration model, Zhao23 with 40 to 200 denoising steps.
We compared ZoDiac and the strongest baseline, StegaStamp, in terms of WDR under different FPR levels, leading to several insights:
Brightness and Contrast Attacks: As the adjustment factors for brightness and contrast decrease from 0.9 to 0.2, the PSNR of the attacked watermarked images drops significantly- 37.79 to 1 11.41 for brightness and from 38.57 14.54 for contrast. Despite this degradation, ZoDiac consistently maintains WDR above 0.99 across all scenarios. Even at extreme settings, where PSNRs fall to 11.41 for brightness and 14.54 for contrast, ZoDiac significantly outperforms StegaStamp. achieving higher WDR and lower FPR. Specifically, ZoDiac records a WDR of 0,994 at an FPR of 0.032 compared to StegaStamp's 's 0.852 at an FPR of 0,056 for brightness, and WDR of 0.998 contrast. This clearly demonstrates ZoDiac 's robustness even under severe quality degradation.
FPR of 0.032 compared to StegaStamp's 's 0.730 at FPR of 0.056 for
JPEG, G-Noise, G-Blur, Bmshj18, and Cheng20 Attacks: With varying attack parameters, including the quality settings for JPEG, Bmshj 18, Cheng20, the standard deviation for G-Noise the kernel size for G-Blur, the PSNR of the attacked watermarked images remains within the range of 20 to 40. In these scenarios, both ZoDiac and StegaStamp consistently sustain a high WDR of around 0.98. The only exception is JPEG with quality setting of 10. Under this condition, the WDR of both ZoDiac and StegaStamp slightly decreases from their usual range 0.956-0.986 to 0. 0.74--0.34 for ZoDiac, and from 0.996- to 0.758-0.806 for StegaStamp.
As the number of image regeneration steps Zhao23 increases, the PSNR the attacked watermarked images decreases from 27.15 to 22.44. Despite this degradation, ZoDiac remains highly resistant across most scenarios, with its WDR slightly decreasing from 0.998 to 0.898. In contrast, StegaStamp significantly underperforms, completely failing when the regeneration steps exceed 120.
Zhao23:
Table 8: The PSNR of attacked watermarked images compared to those without being attacked and the WDR of ZoDiac and StegaStamp under different strengths from 0.2 to 1.0 (i.e., no attack) of the Brightness attack.
Detsction Threshold
WDR under Brightness adjustment factor
HPR
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1.0
PSNR
11.41
13.21
14.56
21.89
27.95
30.84
33.58
37.79
100.0
StegaStomp
61/96
0.056
0.852
0.954
0.988
0.998
1.0
1.0
1.0
1.0
1.0
StegaStamp
6096
0.094
0.890
0.990
1.0
1.0
1.0
1.0
1.0
1.0
1.0
ZoDiac
p" 0.955
0.032
0.984
0.994
0.998
0.998
0.998
ZoDiac
p' 0.90
0.062
0.996
0.996
0.998
0.998
0.998
0.998
0.998
0.998
0.998
Table 9: Results on different attack strengths of the Contrast attack
Detection Threshold
WDR under Coutrast adjustment factor
FPR
0.2
0.7
0.8
0.9
1.0
PSNR
14.54
17.50
23.03
28.62
30.56
33.05
36.57
38.57
100.0
StegaStamp
61,96
0.056
0.730
0.918
0.98
0.998
1.0
1.0
1.0
1.0
1.0
StegaStamp
6096
0.094
0.768
0.956
0.998
1.0
1.0
1.0
1.0
1.0
1.0
ZoDiac
p" 0.95
0.032
0.998
0.996
0.996
0.998
0.998
0.998
0.998
0.998
0.998
ZoDiac
p' = 0.90
0.062
0.994
0.996
0.998
0.998
0.998
0.998
0.998
0.998
0.998
19

---

Table 10: Results on different attack strengths of the JPEG attack.
Detection Threshold
WDR under IPEG quality setting of
FPR
10
20
30
40
50
60
70
80
90
PSNR
28.05
30.82
32.28
33.23
34.02
34.68
35.62
36.88
39,09
StegaStamp
61/96
0.056
0.758
0.996
1.0
1.0
StegaStamp
60/96
0.094
0.806
1.0
1.0
1.0
1.0
1.0
1.0
1.0
1.0
ZoDiac
p 0.95
0.032
0.746
0.956
0.982
0,986
0.992
0.994
0,994
0.994
0.996
ZoDiac
0.90
0.062
0.834
0.986
0.99
0.99
0.992
0.996
0.996
0.996
0.998
Table 11: Results on different attack strengths of the G-Noise attack.
Detection Threshold
WDR under G-Noise standard deviation of
FPR
0.02
0.03
0.04
0.05
0.06
0.07
0.08
0.09
0.1
PSNR
34.04
30.59
24.71
23.41
22.29
21.32
20.45
StegaStamp
61/96
0.056
1.0
1.0
1.0
0,998
0.998
0.998
0,998
0.998
0.996
StegaStamp
60/66
0.094
1.0
1.0
1,0
1.0
1.0
1.0
1.0
1.0
0.998
ZoDiac
0.95
0.032
0.998
0.998
0.908
0,996
0.996
0,996
0.996
0.996
0.994
ZoDiac
0.90
0.062
1.0
0.998
0.996
0.996
0.996
0.996
0.996
Table 12: Results different attack strengths of the G-Blur attack.
Detection Threshold
WDR G-Blur
FPR
9
11
13
PSNR
32.17
29.42
28.00
27.04
26.22
25.60
25.08
24.59
StogaStamp
61/96
0.056
1.0
1.0
0.998
0.998
0.998
0,998
0.996
0.99
StegaStamp
6096
0.094
1.0
1.0
1.0
1.0
1.0
1.0
1.0
0.996
ZoDiac
0.95
0.032
0.996
0.994
0.994
0.994
0.994
0.994
0.994
0,992
ZoDiac
p" 0.90
0.062
0.996
0.996
0.994
0.994
0.994
0.994
0.994
0.994
Table 13: Results on different attack strengths of the Bmshij18 attack.
Dotection Threshold
WDR under Brsshjj18 18 quality setting
FPR
2
3
6
PSNR
30.70
32.26
33,90
35.44
37.17
StegaStump
61/96
0.056
0.996
0.998
StegaStump
60/96
0.094
0.998
1.0
1.0
1.0
1.0
ZoDine
p" 0.95
0.032
0.986
0.986
0.99
0.99
0.992
ZoDinc
0.90
0.062
0.968
0.992
0.992
0.996
0.996
Table 14: Results on different attack strengths of the Cheng20 attack.
Detection Threshold
WDR under Cheng quality setting of
FPR
2
3
4
5
6
PSNR
31.79
33.22
35.07
36.58
37.98
StegaStamp
61/96
0.056
0.994
1.0
1.0
1.0
1.0
StegaStamp
60/96
0.094
0.996
1.0
1.0
1.0
1.0
ZoDiac
p" 0.95
0.032
0.97
0.978
0.98
0.992
0.994
ZoDiac
p 0.90
0.062
0.984
0.986
0.99
0.99
0.994
Table 15: Results on different attack strengths of the Zhao23 attack.
Detection Threshold
WDR under Zhao23 denoising steps of
EPR
200
PSNR
27.15
26.28
25.56
24.91
24.35
23.81
23.33
22,86
22.44
StegaStamp
61/96
0.056
0.588
0.286
0.098
0.032
0.01
0.002
0.002
0.0
0.0
StegaStamp
60/66
0.094
0.674
0.386
0.144
0.06
0.024
0.004
0.002
0.0
0.0
ZoDiac
p" 0.95
0.032
0.98
0.974
0.95
0.94
0.924
0.912
0.894
0.866
0.818
ZoDiac
p" = 0.90
0.062
0.988
0.988
0.964
0.97
0.952
0.946
0.938
0.926
0.898
20

---

B.7 Injecting Watermark into Frequency Space VS Spatial Space
We compare adding watermarks in the spatial domain of the noisy latent, denoted as ZoDiac w/o FT. where FT stands for Fourier Transformation, to freguency-domain-basce approach. As illustrated in Table operating the spatial domain results in degraded PSNR, underscoring to maintain image quality. More significantly. we observe distortions that are visible to the naked eye in the central region of the image, as shown in Figure IO] This indicates that adding watermarks directly to the spatial domain of the noisy latent representation leads to conspicuous patterns in the generated watermarked images, thereby achieving robust watermarking the expense of unacceptable visual artifacts.
importance of utilizing
frequency domain
Table 16: The watermarked image quality and watermark robustness in terms of watermark detection rate (WDR) before and after attack for ZoDiac and its variant ZoDiac w/o FT. The SSIM threshold is set to 0.92.
Image Quality
Watermark Detection Rate (WDR) before and after attack
Method
PSNR SSIM LPIPS Pro-Artack
Post-Attack
Brighmess Contrast JPEG G-Noise G-Blur BM3D Bmshj18 Cheng 7hao23 Rotation
ZoDiac wio
0,92
0.998
ZoDiac
29.41 0,92
0.09
0.998
0.998
0.998
0.992
0.996
0.996
0.994
0.992
0,986
0.988
0.538
Original Image
wio
ZoDiac
Figure 10: Visual comparisons between watermarked images generated by ZoDiac and its variant
ZoDiac w/o FT.
B.8
Discussion on Composite Attack
When performing composite attacks, the order executing individual attacks may influence the watermarked detection rate. We evaluate with another composite attack All w/o O Rev.". which is the reversed order of All w/o : in Table 17 The slightly decreasing WDR of All w/o O Rev. from 0.510 0.548 to 0.456 0.490. indicates that the order of the attack execution also plays role in attacking watermarked images. is worthwhile deeply investigate composite attacks and develop image watermarking methods robust to various cases in the future.
Table 17: ZoDiac's watermark detection rate (WDR) two composite attacks, "All w/o that combines all the individual attacks but excludes the rotation, and "All w/o & Rev." that in the reversed order.
ZoDiac Watermark Detection Rate (WDR)1
Attack
MS-COCO DiffusionDB
WikiArt
All w/o O All w/o c) Rev.
0.510
0.548 0.508
0.530
0.490
0.456
21

---

C More Attack Discussion
C.1 About Rotation Attack
The rotation attack presents a significant challenge for most existing watermarking methods, including ZoDiac (see T. There are two strategics to mitigate this issuc. The first approach, exemplificd by SSL, integrates rotation into the model's training phase as type of data augmentation. However, this method is incompatible with ZoDiac's s zero-shot nature. The second approach involves rectifying the image's 's orientation prior to watermark detection. This correction can be achieved manually or via automated process by systematically rotating the image through a series of predetermined angles, spanning the full 360-degree spectrum and performing watermark detection at each increment. We call this the "rotation auto correction" defense.
In this study, we test rotation auto-correction with ZoDiac. We conduct experiments using intervals of 5, 10, and 30 degrees and report the Watermark Detec- tion Rate (WDR) for watermarked images subjected to the 90-degree rotation attack, and the False Positive Rates (FPR) for unmarked images. Table [8] reports the results on the MS- MS-COCO dataset. As expected, applying rotation auto-correction enables ZoDiac to achieve higher WDR. However, it also increases the risk of detecting a watermark in unmarked images, leading to a higher FPR. A higher detection threshold p = 0.99 can greatly suppress FPR with a slight to
Table 18: ZoDiac's watermark detection rate (WDR) and false positive rate (FPR) under Ro- tation attack, with automatic correction of image orientation.
MS-COCO, 8' 0.92 Detection Threshold p' WDR
FPR
0.538
0.062
No Correction
0.99
0.376
0.004
0.998 0.676
0.99
0.992 0.034
Correction Rotation Step Size
0.9
0.998
0.432
0.99
0.992 0.016
decrease in WDR, decreasing from 0.011-0.034. Therefore in practice, to deploy rotation auto-correction defense, the higher detection threshold is appropriate.
0.9
0.998
0.244
30
0.99
0.992
0.014
C.2 bout Pipeline-Aware Attack
Conducting pipeline-aware attack involves simulating what a knowledgeable attacker would do if they were aware of how our watermarking works. The goal is to evaluate the robustness of ZoDiac against worldworld threats where attackers might have insights into the defense strategies used. Specitically, assume the attacker can inject another watermark to potentially disrupt or overwrite the original one by using ZoDiac, while testing whether the original watermark can still he preserved.
Table 19 reports the Watermark Detection Rate (WDR) for both the original and newly injected wa- termarks under four scenarios according to the extent of information available the attacker. When the attacker has only partial knowledge our watermark- ing method, such as lacking the model weights (i.e., the second row) or boing unaware of the watermark in- jection configurations, including the injection channel and watermark radius (i.c., the third row), or both (i.c., the first row), the original watermark remains undis- turbed by the new one and it is successfully detected with a high WDR. However, when the attacker has complete knowledge of the watermarking pipeline used for injecting
Table 19: The Watermark Detection Rate (WDR) for both the original and newly injected water- marks under four scenarios according to whether the attacker knows the model weights and the in- jection configurations of the original watermark.
Model Weights
Watermark Setting Original WDR
New WDR
0.998
0.952
0.992
0.998
0.998
0.98
0.106
0.998
original watermark (i.e.. the fourth row), the original watermark is unfortunately overwritten by the new one. The results confirm the robustness of our proposed ZoDiac in the face of partial knowledge adaptive attacks and also underscore the critical importance of safeguarding the model weights and watermark configurations to ensure security.
D GPU Usage and Time Cost
The GPU usage of ZoDiac is 15,552MiB when operating with 32-bit floating-poin precision. This memory is primarily attributed the activation maps and model parameters required for the diffusion model computations, where the model parameters take 5,308MiB memory. All the experiments are conducted with NVIDIA RTX8000.
Since ZoDiac is a zero-shot watermarking method based on the well-trained diffusion model, the time cost is solely attributed to optimizing the noisy latent representation of the given image embedded with the watermark. Therefore the time cost is influenced by the selected denoising step during the reconstruction of the watermarked
22

---

image. The completion of reconstruction is determined when the SSIM loss falls below 0.2 (i.e., the SSIM metric for the watermarked image quality exceeds 0.8) the maximum number of iterations (i.e., 100) reached.
As shown in Table 20 the larger the denoising step. the longer each iteration will take, consequently increasing the overall time cost. Regarding average convergence iterations, as the denoising step decreases, ZoDiac requires slightly fewer itera- tions to achieve similar performance. This might be attributed the shallower steps of gradient backpropagation, leading to faster convergence. Notice when the denoising step de- creased to I, becomes harder to reconstruct a watermarked image with a quality above 0.8, making it more challenging trigger the early exit condition based the SSIM loss
Table 20: Average convergence iterations, time cost per iteration, and time cost per image when utilizing different denoising steps for watermarking image.
Denoising Steps
Avg- Iteration
Time Cost (s/iter)
Time Cost (s/Img)
50
43.9
5.83
255.94
threshold. Consequently, leads longer convergence itera-
30
42.3
3.77
159.47
tions case. Additionally, we have demonstrated that denoising steps do not significantly impact the watermarking performance. The detailed results and analysis provided Appendix [3.2 Therefore, could always choose small denoising steps to effectively embed robust watermarks while maintaining a reasonable time cost.
10
38.9
1.68
65.35
1
68.1
0.66
45.41
E
Visual Examples
Figure shows several image examples, taken from each of three datasets. For each image, show the original, watermarked versions with seven watermarking methods, including ZoDiac, and residual images (i.e., the watermarked image minus the original image). We observe that ZoDiac does not introduce significant visible degradation. We can hardly observe image differences for the DwtDet, RivanGAN, and SSL methods. small amount of differences for DwtDetSvd, CIN, and our proposed ZoDiac, and significant amount for StegaStamp. Notably, DwtDet, RivanGAN, and SSL suffer from poor robustness against advanced attacks, while ZoDiac achieves a favorable trade-off between visual quality preservation and robust watermarking.
Image
DwtiDct
DwiDetSivd
RivGAAN
SSL
CIN
StegaStamp
ZoDisc
Figure 11: Visual examples different invisible watermarking methods together with corresponding residual images (zoom in for details). The top two rows show real photos from the MS-COCO dataset, the next two rows show Al Al-generated content from DiffusionDB, and the last two rows are artworks from WikiArt. The SSIM threshold for ZoDiac is 0.92 for these examples.
F
Impact Statement
Our work advances robust image watermarking research field. In particular, we produce model-based image watermarking method that is resilient to advanced watermark removal attacks, such as a diffusion-mode
diffusion-
attack and attacks composed of multiple, individual attack methods, Our method enables content protection and authenticity verification, positively impacting visual artists and other visual content creators. Our technique may machine learning and is thus susceptible learning, such as bias, which may result negative socictal impact.
of the pitfalls of machine
23

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: We proposed a robust image watermarking method hased on stable diffusion models called ZoDiac. In the abstract and introduction, we provide our motivation in Figure T and elaborate its robust and effective features with experimental results.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the
results can he expected to generalize to other settings.
is fine to include aspirational goals as motivation long it is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors? Answer: [Yes]
Justification: We discuss the robustness limitation when facing rotation attack and attack with full knowledge of our pipeline in Appendix [ We also mention that ZoDiac focuses on zero-bit bit water- marking without meaningful information in the conclusion. Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings. model well well-speciffiction
asymptotic approximations only holding locally). The authors should reflect on how these assumptions might he violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e-g., the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
applicable, the authors should discuss possible limitations their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory A Assumptions and Proofs Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
Answer: [No]
Justification: We do not include theoretical results. Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross reforeeefeeeeed..
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs either appear the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by
formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
24

---

4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: We provide the pscudocode of ZoDiac in Algorithm to help with implementing the watermarking method, and also provide configurations for all the necessary hyperparameters in Section
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments. No answer to this question will not be perceived well by the reviewers: Making the paper reproducible important, regardless whether the code and data are provided or not.
If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For contribution novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of a large language model), releasing of model checkpoint, or other means that are appropriate to the research performed.
example,
While NeurIPS does not require releasing code, the conference does require all submissions provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should deseribe the architecture clearly and fully.
(c) the contribution is a new model (c.g., a large language model), then there should either be a way to access this model for repraducing the results or a way to reproduce the model (e.g.. with open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reprodueibility. In the case of closed-source source models, it may be that access to the model is limited in some way (e.g.. to registered users). but it should be possible for other researchers to have some path to reproducing verifying the results.
Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: The code Github link is provided in the abstract. Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips. http://iiipcccpppliii.cc cc/public/ sossSubbisioooooooooo for more details.
While we encourage release of code and data, we understand that this might not possible,
so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for a new open-source henchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (httpa://nipp cc/ cc/bulicc/ guides/CodeSuubnin htt///oodduuiiiiiiinooeeeeeeeeee
for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed
method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted. 6. Experimental Deeting/Details
Question: Does the paper specify all the training and test details (e.g.. data splits, hyperparameters. how they were chosen, type of optimizer, etc.) necessary understand the results?
25

---

Answer: [Yes]
Justification: We provide configurations for all the necessary hyperparameterss in Section 4.1 and also
additional ablation studies for the choice of these hyperparameters in Section 4.4 and Appendix [
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary appreciate the results and make sense of them.
'Tee full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error hars suitably and correctly defined or other appropriate informa- tion about the statistical significance of the experiments?
Answer: [No]
Justification: We do not report error bars, since our watermarking method is a deterministic process that will inject the watermark into the given image. The watermark detection rate will only be changed when using different SSIM thresholds and detection thresholds, and we discuss the influence of different configurations in Section 4.4 and Appendix Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given
experimental conditions).
The method for calculating the bars should be explained (closed form formula, call library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors). It should be clear whether the error bar is the standard deviation the standard error of the mean.
It OK report I-sigma error bars, one should it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of crrors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric bars that would yield results that are of range (e.g. negative
rates). error bars are reported tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
Question: For each experiment. does the paper provide sufficient information the computer resources (type of compute workers, memory, time exccution) needed reproduce the experiments?
Answer: [Yes]
Justification: The GPU memory consumption and the time cost are reported in Appendix D Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud
provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code Of Ethics
Question:
Does the research conducted in the paper conform, in every respect, with the NeurIPS Code wwtpppwicccp.c.ccccccccc...ppppe wtwp:/hhhhhccccieeeeeeeeeeeee
Ethics
Answer: [Yes]
Justification:
Our rescarch conforms with NeurIPS Code of Ethics and we provide impact statement in
Appendix
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make sure preserve anonymity (e.g., if there is special consideration due laws or regulations their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
26

---

Answer: [Yes]
Justification: We provide impact statement in Appendix F
Guidelines:
The answer NA means that there is no socictal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no socictal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g.. disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deploy- ment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications. the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it not needed point out that generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release models, providing defenses in addition to attacks, mechanisms for monitor- ing misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of MI).
11. Safeguards
Does the paper describe safeguards that have been put in place responsible release of data or models that have a high risk for misuse (e.g.. pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: This paper poses no such risks. Guidelincs:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards allow for controlled use of the model, for example by requiring that adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should
describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (c.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected? Answer: [Yes]
Justification: We cited existing datasets and pre-trained models we used. Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, possible, include a URL.
The name of the license (e.g.. CC-BY 4.0) should be included for each asset. For scraped data from particular source (e.g., website), the copyright and terms of service of that source should he provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets. paperswi thcode. com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. For existing datascts that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
this information not available online, the authors are encouraged to reach out the asset's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: This paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release assets.
27

---

Researchers should communicate the details of the dataset/code/mmoel as part of their sub- missions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember anonymize your assets (if applicable). You either create anonymized URL include anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: This paper does not involve crowdsourcing or research with human subjects.
Guidelincs:
The answer NA means that the paper does not involve crowdsourcing rescarch with human
subjects.
Including this information in supplemental material is fine, but main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage country the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country institution) were obtained? Answer: [NA]
Justification: This paper does not involve crowdsourcing or research with human subjects.
Guidelincs:
The answer NA means that the paper does not involve crowdsourcing rescarch with human subjects.
Depending on the country which research is conducted, approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere to the NeurIPS Code Ethics and the guidelines for their institution.
For initial suhmissions, do not include any information that would break anonymity (if applica- ble), such as the institution conducting the review.
28


Reviews:
[{"review_id": "JL2H4FxqWF", "reviewer": "Reviewer_r9M9", "summary": "This paper presents ZoDiac, a novel image watermarking technique leveraging a pre-trained stable diffusion model to inject watermarks into a trainable latent space, enhancing watermark robustness against image attacks. Extensive experiments on three modern benchmarks demonstrate ZoDiac’s state-of-the-art watermark detection accuracy, outperforming existing methods in the face of traditional and generative model-based watermark removal attacks.", "questions": "See the weaknesses.", "limitations": "N.A.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. This paper is well-structured.\n2. The authors claim that they have proposed for the first time an invisible watermark embedding framework that is robust to stable diffusion-based watermark removal attacks.\t\t\t\t\t\t\t\t\t\n3. Extensive experiments have been conducted.", "weaknesses": "1. While ZoDiac demonstrates excellent robustness under various attacks, as shown in Table 1, it sacrifices image quality, achieving only slightly better visual quality than StegaStamp.\n\n2. As the authors mentioned, the main weakness of the current method is that it is limited to zero-bit watermarking. How to increase the length of the embedded information is an issue that needs to be addressed.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your positive comments and rating! Below we provide one-to-one responses to the two mentioned weaknesses.\n\n**W1: While ZoDiac demonstrates excellent robustness under various attacks, as shown in Table 1, it sacrifices image quality, achieving only slightly better visual quality than StegaStamp.**\n\n**A1:** We appreciate your observation regarding the trade-off between image quality and watermark robustness, which is a recognized challenge in watermarking techniques. Indeed, ZoDiac prioritizes watermark robustness, as shown in Table 1, which may result in a slight reduction in image quality. However, this reduction does not cause significant visible degradation, as evidenced by the corresponding watermarked images in Figure 11 in Appendix E. Furthermore, the trade-off curves in Figure 3 and Figures 6 to 8 in the Appendix also demonstrate that ZoDiac can even obtain comparable visual quality while achieving watermark robustness that is still on par with or surpasses existing state-of-the-art methods.\n\n**W2: As the authors mentioned, the main weakness of the current method is that it is limited to zero-bit watermarking. How to increase the length of the embedded information is an issue that needs to be addressed.**\n\n**A2:** We agree with you that extending ZoDiac to encode longer information is an exciting and valuable direction for future research. One potential approach is to develop an encoding-decoding mechanism that converts meaningful information into a Gaussian distribution, which can adhere to the distribution constraint in the latent vector of the diffusion model. We are committed to exploring this avenue and making progress in this area.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ht14Dh9R53", "reviewer": "Reviewer_mbRv", "summary": "The paper introduces ZoDiac, an image watermarking framework leveraging pre-trained stable diffusion models to embed concentric ring-like zero-bit watermark into existing images. ZoDiac operates by injecting the watermark into the trainable latent space. The method is extensively evaluated on three benchmarks MS-COCO, DiffusionDB, and WikiArt, demonstrating strong effectiveness and robustness, outperforming existing methods. ZoDiac is notable for its ability to watermark both AI-generated and real-world images without requiring extensive retraining, and it remains effective even against combined attack scenarios.", "questions": "- Since previous works use different types of watermark, such as StegaStamp uses hyperlink bitstring, there is a concern regarding comparison fairness, hence the demonstrated results might be misleading. It would be better if the authors can provide clarification on this. \n- It will be interesting to see if ZoDiac can work with watermark of different patterns. \n- Other than UNet-based latent diffusion models like Stable Diffusion, it will be exciting to see if ZoDiac can work with Transformer-based ones like Pixart-alpha [1] or DiT [2].\n\n[1]. Chen, J., Yu, J., Ge, C., Yao, L., Xie, E., Wu, Y., Wang, Z., Kwok, J., Luo, P., Lu, H., Li, Z.: PixArt-α: Fast training of diffusion transformer for photorealistic text-to-image synthesis. In: ICLR (2024)\n\n[2]. William Peebles and Saining Xie. Scalable diffusion models with transformers. In ICCV, 2023.", "limitations": "The authors have adequately addressed the limitations and potential negative societal impact of their work.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The overall paper is easy to read and clear.\n- Comprehensive experiments have been done to show effectiveness and robustness of ZoDiac against single or combinations of different attacks whereas several previous methods failed.\n- ZoDiac does not need extensive training by leveraging pre-trained stable diffusion models, saving time and computational resources.", "weaknesses": "- The method seems inefficient as it needs 45.4 - 255.9s to watermark one image. \n- While the paper demonstrates empirical robustness, it lacks theoretical support to explain why the approach is resilient to various attacks. The hypothesis about the reciprocating denoising process enhancing robustness of the watermark is not rigorously proven.\n- The paper lacks experiments with watermark of different patterns apart from the concentric ring-like one.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your positive comments and rating! Below we provide one-to-one responses to the three questions.\n\n**Q1: Since previous works use different types of watermark, such as StegaStamp uses hyperlink bitstring, there is a concern regarding comparison fairness.**\n\n**A1:** Please refer to the global response to all reviewers. Thank you!\n\n**Q2: It will be interesting to see if ZoDiac can work with watermark of different patterns.**\n\n**A2:** The choice of a concentric ring-like pattern for our watermark is influenced by two key factors:    \n(1) After frequency shifting, the center of the frequency map contains the low-frequency components, which can be slightly modified without significantly impacting the image content. This allows us to embed the watermark while maintaining the visual integrity of the image.    \n(2) The frequency domain exhibits Hermitian symmetry, where the real part is even symmetric and the imaginary part is odd symmetric. This symmetry makes circularly symmetric watermarks the most straightforward option to align with this natural property.\nThese considerations together led us to select the concentric ring-like watermark pattern. And we are excited about the potential to extend our approach to other patterns. Different patterns may open new possibilities for encoding longer and more meaningful information. \n\n**Q3: It will be exciting to see if ZoDiac can work with Transformer-based ones like Pixart-alpha or DiT.**\n\n**A3:** As requested, we have conducted additional experiments using the latest Transformer-based diffusion model, Huanyuan-DiT [1], and present the performance results in Tables 1 and 2 using MS-COCO dataset.    \nDue to the time limit, the denoising step inside each optimization iteration for ZoDiac with DiT is set to 1 for the fastest watermarking on 50 images, and the SSIM threshold is set to 0.92 for fair comparison. Results from ZoDiac with other backbones are from Figure 9 in the paper and uses 50 iterations. **In summary, our method can seamlessly integrate with any stable diffusion backbone and achieve good performance.** The experimental results demonstrate the robustness of our approach, regardless of the specific diffusion model being employed.\n\n**Table 1. Watermarked image quality of ZoDiac with different backbones.**\n|       Backbone      | PSNR (&uarr;) | SSIM (&uarr;) | LPIPS (&darr;) |\n|:-------------------:|:-------------:|:-------------:|:--------------:|\n|      StegaStemp     |     28.64     |      0.91     |      0.13      |\n|  ZoDiac w/ 2.1base  |     29.41     |      0.92     |      0.09      |\n|    ZoDiac w/ 1.4    |     29.40     |      0.92     |      0.09      |\n| ZoDiac w/ XL1.0base |     29.41     |      0.92     |      0.09      |\n|    **ZoDiac w/ DiT**    |     28.55     |      0.92     |      0.13      |\n\n**Table 2. Watermark Detection Rate (WDR) (&uarr;) before and after attacking.**\n|       Backbone      | Pre-Attack | Brightness | Contrast |  JPEG | G-Noise | G-Blur |  BM3D | Bmshj18 | Cheng20 | Zhao23 | Rotation |\n|:-------------------:|:----------:|:----------:|:--------:|:-----:|:-------:|:------:|:-----:|:-------:|:-------:|:------:|:--------:|\n|      StegaStemp     |    1.000   |    0.998   |   0.998  | 1.000 |  0.998  |  1.000 | 0.998 |  0.998  |  1.000  |  0.286 |   0.000  |\n|  ZoDiac w/ 2.1base  |    0.998   |    0.998   |   0.998  | 0.992 |  0.996  |  0.996 | 0.994 |  0.992  |  0.986  |  0.988 |   0.538  |\n|    ZoDiac w/ 1.4    |    0.996   |    0.994   |   0.996  | 0.992 |  0.994  |  0.996 | 0.998 |  0.990  |  0.984  |  0.984 |   0.536  |\n| ZoDiac w/ XL1.0base |    0.998   |    0.998   |   0.998  | 0.992 |  0.994  |  0.998 | 0.996 |  0.992  |  0.986  |  0.986 |   0.536  |\n|  **ZoDiac w/ DiT**  |    1.000   |    0.998   |   0.998  | 0.996 |  0.996  |  0.996 | 0.996 |  0.992  |  0.990  |  0.988 |   0.538  |\n\n[1] Li, Zhimin, et al. \"Hunyuan-DiT: A Powerful Multi-Resolution Diffusion Transformer with Fine-Grained Chinese Understanding.\" arXiv preprint arXiv:2405.08748 (2024).", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Dt6D1ob6fa", "reviewer": "Reviewer_AMWU", "summary": "This paper presents a new image watermarking method, ZoDiac, which leverages pretrained stable-diffusion model to generate watermark in the latent space (derived by using DDIM to process the original image). The author claims that ZoDiac achieves better robustness than the state-of-the-art (SOTA) watermarking methods.", "questions": "1. Are all watermarking methods compared fairly?\n\nAs stated in line 238 and 252, the watermark detection for the proposed ZoDiac relies on a threshold of (1-p). Analogously, for all other watermark competitors considered in this paper (DwtDctSvd, RivaGAN, SSL, CIN, StegaStamp), the watermark detection relies on thresholding the bitwise accuracy (or bit-error-rate in CIN) between the decoded bitstring and the ground truth. Altering these thresholds will lead to different trade-off points of True-Positive-Rate (TPR) and False-Positive-Rate (FPR) in the watermark detection performance. \n\nThe authors seem to be aware of this trade-off as in line 252 they report the detection threshold for ZoDiac; in line 11 they stress that ZoDiac has more than 98% TPR and less than 6.4% FPR; and in Table 3 they present an ablation study for ZoDiac. However, the detection threshold and FPR number for other watermarking methods are never mentioned in this paper (including Appendix). Imagine if another method (let’s call it B) achieves 97% TPR and 3% FPR, is ZoDiac or B more robust? As a result, I do not think the current evaluation is fair to compare the robustness of all watermarking methods.\n\nConsidering the fact that the detection threshold for each method may not be comparable, it would be reasonably fairer to make the following comparison to demonstrate robustness—let all methods achieve the same TPR then compare their FPR; or vice versa. In fact, the best demonstration here would be profiling the TPR-FPR curve for all watermarking methods to show the whole picture.\n\n2. Has the definition of robustness clearly explained in this paper?\n\nAccording to line 94-96, the robustness is defined as “watermark being detectable in attacked images” and attacked images should be “without significantly changing the image”. Have the authors defined and justified what is “significant”? Without properly addressing the question of “significance”, the robustness is essentially a trade-off between three quantities: (1) TPR, (2) FPR, and (3) attack image quality (inverse significance). Imagine that the attacked images are all with very severe additive gaussian noise such that no watermark can be correctly detected by any method considered, can we conclude that all watermarks are equally (non)robust? An example of justification can be found in [1], e.g., the contribution (1) and (2) mentioned. This may not be perfect but explains why [1] performs the robustness evaluation as Fig 3. I suggest the authors carefully consider this question, make the justification of their consideration and adjust their evaluation experiment accordingly, which may change/bring new insights to their robustness conclusions.\n\n3.  Can you justify the selection of the attack methods used in testing the robustness? What is the criterion/consideration in selecting these attacks?\n\nAll the benchmark attacks considered in this paper (Brightness, Contrast, JPEG, Gaussian noise, Gaussian blur, BM3D, Bmshj18, Cheng20, Zhao23) have tunable parameters (e.g., corruption level, standard deviation, compression rate, kernel size, etc.) to adjust the attack strength. However, the author did not provide any information on what levels of these attacks are used in the experiment. Altering these parameters will inevitably affect the TPR-FPR-imageQuality trade-off. It is essential for the authors to provide details of the choice of these parameters and justify how it is related to the robustness considered in this paper.\n\n[1] An, Bang, et al. \"WAVES: Benchmarking the Robustness of Image Watermarks.\" Forty-first International Conference on Machine Learning.", "limitations": "N/A. There's no possible negative social impact that needs to discuss explicitly.", "rating": 7, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The idea proposed in this work is original. The paper also introduces the proposed method clearly and with sufficient details.", "weaknesses": "Lack of sufficient details for the benchmark methods (both other watermark competitors and the attack methods), making it questionable if the comparison of robustness is fair and significant; the experiments and the logic conveyed in this paper is not convincing enough to support the claim that ZoDiac is more robust than the existing SOTA method, i.e.., StegaStamp. Please see “Questions” below for detailed comments.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your constructive comments and critical feedback. Below we provide one-to-one responses and detailed discussions.\n\n**Q1: Are all watermarking methods compared fairly?**\n\n**A1:** Please refer to the global response to all reviewers. Thank you!\n\n**Q2: Has the definition of robustness clearly explained in this paper?**    \n**Q3: Can you justify the selection of the attack methods used in testing the robustness?** \n\n**A2&3:** We address these two questions together as they are closely related.\n\nWe define watermark robustness as **the ability to detect the encoded watermark in images after they have been subjected to malicious attacks**, as mentioned in lines 94-96. Consider a real scenario involving the use of image watermarking techniques. An image owner will watermark their work before publishing it online. Malicious actors may then attempt to remove the watermark and republish the image. **The goal of these attacks is to maintain the image quality within an acceptable range of the published watermarked images while removing the watermark.**\n\nConsequently, when evaluating the robustness of watermarking methods, **we selected attack methods that do not cause significant image changes, as measured by PSNR and SSIM metrics relative to the watermarked images before the attack.** Specifically, we adopted the attack methods used in [1] as mentioned in line 264. These attacks degrade the image slightly but still maintain acceptable PSNR (above 25dB) and SSIM (above 0.7) levels (refer to Table 1 in [1]). \n\nFor your reference, we provide the detailed attack settings below and will include these details in the paper:\n- Adjustments in brightness or contrast with a factor of 0.5.\n- JPEG compression with a quality setting of 50.\n- Image rotation by 90 degrees.\n- Addition of Gaussian noise with a std of 0.05.\n- Gaussian blur with a kernel size of 5 and std of 1.\n- BM3D denoising algorithm with a std of 0.1.\n- Two VAE-based image compression models, Bmshj18 and Cheng20 with compression factors of 3.\n- A stable diffusion-based image regeneration model, Zhao23 with 60 denoising steps.\n\nIn Table 1, we also present the image quality of the attacked watermarked images on the MS-COCO dataset in our experiments. Our results indicate that the image quality of the attacked watermarked images is not significantly degraded compared to the watermarked versions. An exception is the image rotation by 90 degrees, which results in lower PSNR and SSIM due to the rotated content; however, this case is still worth discussing as it presents unique challenges, as detailed in line 300-305 and Appendix Section C.1.  In short, **we expect a robust watermarking method to detect the watermark from these slightly degraded images.**\n\n**Table 1. The image quality of the attacked watermarked images compared to those without being attacked.**\n| Attack Methods | PSNR (&uarr;) | SSIM (&uarr;) |\n|:--------------:|:-------------:|:-------------:|\n|   Brightness   |     21.89     |      0.73     |\n|    Contrast    |     28.62     |      0.83     |\n|      JPEG      |     34.02     |      0.92     |\n|     G-Noise    |     26.26     |      0.75     |\n|     G-Blur     |     32.17     |      0.92     |\n|      BM3D      |     35.72     |      0.92     |\n|     Bmshj18    |     32.26     |      0.89     |\n|     Cheng20    |     33.22     |      0.90     |\n|     Zhao23     |     26.28     |      0.91     |\n|    Rotation    |      9.90     |      0.28     | \n\n[1] Zhao, Xuandong, et al. \"Invisible image watermarks are provably removable using generative ai.\" arXiv 2023.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
Thank you for your comments and suggestions. We first provide a general response to all reviewers with additional details. 

**Q: Are all watermarking methods compared fairly? (Reviewer mbRv Q1, Reviewer AMWU Q1)**   
**A:** Yes, our evaluation is designed to guarantee fair comparison with existing methods. We fully agree with the importance of performing fair comparisons and always keep this principle in mind when conducting experiments. To address your concerns comprehensively,  we'll elaborate on three key aspects.

**Q1.1: What are the threshold settings for the compared existing methods?**    
**A1.1:** We adopted settings from a recent evaluation paper [1], using 32-bit messages for DwtDct, DwtDctSvd, RivaGAN, SSL, and CIN, and 96-bit messages for StegaStamp. Detection thresholds were set to reject the null hypothesis (i.e., $H_0$: the image has no watermark) with $p < 0.01$, requiring correct detection of 24/32 and 61/96 bits for the respective methods, as detailed in Section 2.3 in [1].

[1] Zhao, Xuandong, et al. "Invisible image watermarks are provably removable using generative AI." arXiv 2023.

**Q1.2: What is the False-Postive-Rate (FPR) of the compared existing methods?**    
**A1.2:** Following your suggestion, we will extend Table 1 in the paper to include FPR for all the baselines and datasets. In summary, under the same FPR level, Zodiac always achieves a higher Watermark Detection Rate (WDR), demonstrating its superiority on watermark robustness. Please refer to the next question Q1.3 for detailed analysis.

Below we provide FPR (non-watermarked images detected as watermarked) and WDR (watermarked images detected as watermarked) before and after attacking for all the methods on the MS-COCO dataset. We also include our results with different watermark detection thresholds $p^*\in{0.90,0.95,0.99}$ in Table 5 from the Appendix to ease the comparison.

**Table 1. False Positive Rate (FPR, lower the better) on original images and Watermark Detection Rate (WDR, higher the better) on watermarked images before and after attacking. (Results on MS-COCO dataset)**
|   Watermarking Method   |  FPR  | Pre-Attack | Brightness | Contrast |  JPEG | G-Noise | G-Blur |  BM3D | Bmshj18 | Cheng20 | Zhao23 | Rotation | Avg. WDR |
|:-----------------------:|:-----:|:----------:|:----------:|:--------:|:-----:|:-------:|:------:|:-----:|:-------:|:-------:|:------:|:--------:|:--------:|
|          DwtDct         | 0.052 |    0.790   |    0.000   |   0.000  | 0.000 |  0.687  |  0.156 | 0.000 |  0.000  |  0.000  |  0.000 |   0.000  |   0.148  |
|        DwtDctSvd        | 0.018 |    1.000   |    0.098   |   0.100  | 0.746 |  0.998  |  1.000 | 0.452 |  0.016  |  0.032  |  0.124 |   0.000  |   0.415  |
|         RivaGAN         | 0.036 |    1.000   |    0.996   |   0.998  | 0.984 |  1.000  |  1.000 | 0.974 |  0.010  |  0.010  |  0.032 |   0.000  |   0.637  |
|           SSL           |   0   |    1.000   |    0.992   |   0.996  | 0.046 |  0.038  |  1.000 | 0.000 |  0.000  |  0.000  |  0.000 |   0.952  |   0.457  |
|           CIN           | 0.026 |      1     |      1     |     1    | 0.944 |    1    |    1   | 0.580 |  0.662  |  0.666  |  0.478 |   0.216  |   0.777  |
|        StegaStamp       | 0.056 |    1.000   |    0.998   |   0.998  | 1.000 |  0.998  |  1.000 | 0.998 |  0.998  |  1.000  |  0.286 |   0.000  |   0.843  |
| **ZoDiac -** $p^*=0.90$ | 0.062 |    0.998   |    0.998   |   0.998  | 0.992 |  0.996  |  0.996 | 0.994 |  0.992  |  0.986  |  0.988 |   0.538  |   **0.952**  |
| **ZoDiac -** $p^*=0.95$ | 0.030 |    0.998   |    0.996   |   0.998  | 0.992 |  0.996  |  0.996 | 0.994 |  0.986  |  0.978  |  0.974 |   0.376  |   **0.935**  |
| **ZoDiac -** $p^*=0.99$ | 0.004 |    0.992   |    0.99    |   0.99   | 0.978 |  0.984  |  0.988 | 0.988 |   0.96  |  0.954  |  0.938 |   0.106  |   **0.897**  |

**Q1.3: How do we form a fair comparison?**

**A1.3:** We ensure fair comparisons with all the existing watermarking methods by following two criteria:

**(1) Comparison at equivalent FPR levels:**    
We compare WDR across different attack methods at the same FPR level. ZoDiac-$p^*=0.95$ outperforms DwtDct, RivaGAN, CIN, and StegaStamp with higher average WDR and lower FPR. When compared with DwtDctSvd and SSL, ZoDiac-$p^*=0.98$ consistently achieves higher WDR under competitive FPR, particularly against advanced watermark removal methods, Bmshj18, Cheng20, and Zhao23. 

**(2) Comparison at the same watermark detection threshold:**    
As described in A1.1, the decision threshold for existing methods is set to $p<0.01$ to reject the null hypothesis, which is equivalent to our $p^*=0.99$ threshold. Thus we compare ZoDiac-$p*=0.99$ with baselines. ZoDiac-$p^*=0.99$ maintains a higher average WDR while achieving an exceptionally low FPR of 0.004, highlighting the superiority of our method.

These comparisons demonstrate that ZoDiac offers robust performance across different attack methods and evaluation metrics, outperforming existing watermarking methods in challenging scenarios.

Meta-review: This paper has received consistent feedback from all three reviewers. The reviewers engaged in thorough discussion and rebuttal, with most of their concerns being addressed, ultimately reaching a consensus. The paper proposes a framework for embedding invisible watermarks into existing images using a pretrained stable diffusion model. The experiments are comprehensive and effective. Therefore,  the AC  has decided to accept this paper.
Decision: Accept (poster)