T2SMark: Balancing Robustness and Diversity in Noise-as-Watermark for Diffusion Models
Authors: Jindong Yang
Han Fang
Weiming Zhang
Nenghai Yu
Kejiang Chen
Venue: NeurIPS 2025 poster ()
Keywords: Watermark
Diffusion Models
Primary area: applications

Abstract: Diffusion models have advanced rapidly in recent years, producing high-fidelity images while raising concerns about intellectual property protection and the misuse of generative AI. Image watermarking for diffusion models, particularly Noise-as-Watermark (NaW) methods, encode watermark as specific standard Gaussian noise vector for image generation, embedding the infomation seamlessly while maintaining image quality. For detection, the generation process is inverted to recover the initial noise vector containing the watermark before extraction. However, existing NaW methods struggle to balance watermark robustness with generation diversity. Some methods achieve strong robustness by heavily constraining initial noise sampling, which degrades user experience, while others preserve diversity but prove too fragile for real-world deployment. 
To address this issue, we propose T2SMark, a two-stage watermarking scheme based on Tail-Truncated Sampling (TTS). 
Unlike prior methods that simply map bits to positive or negative values, TTS enhances robustness by embedding bits exclusively in the reliable tail regions while randomly sampling the central zone to preserve the latent distribution. Our two-stage framework then ensures sampling diversity by integrating a randomly generated session key into both encryption pipelines. 
We evaluate T2SMark on diffusion models with both U-Net and DiT backbones. Extensive experiments show that it achieves an optimal balance between robustness and diversity.

T2SMark: Balancing Robustness and Diversity in Yoise-as-Watermen for Diffusion Models
Jindong Yang
Han Fang"*, Weiming Zhang Nenghai Yu Kejiang Chen 1.2
University of Science and Technology of China
2 Anhui Province Key Laboratory of Digital Security National University of Singapore dx9290mail ustc. ust en, fanghan@nus edu. sg (ynh, zhangwm, chenkj)@ustc. edu, on
Abstract
Diffusion models have advanced rapidly in recent years, producing high-fidelity images while raising concerns about intellectual property protection and the misuse of generative AI. Image watermarking for diffusion models, particularly Noise- as- as-Watermark (NaW) methods, encode watermark as specific standard Gaussian noise vector for image generation, embedding the infomation seamlessly while maintaining image quality. For detection, the generation process is inverted to re- cover the initial noise vector containing the watermark before extraction. However, existing NaW methods struggle to balance watermark robustness with generation diversity. Some methods achieve strong robustness by heavily constraining initial noise sampling, which degrades user experience, while others preserve diversity but prove too fragile for real-world deployment. To address this issue, we propose T2SMark, a two-stage watermarking scheme based on Tail-Truncated Sampling (TTS). Unlike prior methods that simply map bits positive or negative values, TTS enhances robustness by embedding bits exclusively in the reliable tail regions while randomly sampling the central zone to preserve the latent distribution. Our two-stage framework then ensures sampling diversity by integrating randomly generated session key into both encryption pipelines. We evaluate T2SMark on diffusion models with both U-Net and DiT backbones. Extensive experiments show that achieves an optimal balance between robustness and diversity.
Introduction
In recent years, diffusion models [4 have achieved groundbreak- ing advances in generative AI, especially in image synthesis. Owing to their iterative denoising process, these models can produce highly realistic images. As their architecture scales and training datasets expand, diffusion models continually improve in both generation quality and controllability, driving rapid progress in AIGC technolo-
Rebustues (nseerudd by saviee acqupvo)
Causcin Shating
(us
Better
gies.
WoG-Woiamot 03t
However, this swift evolution also brings new challenges: the au- thenticity of generated content is increasingly difficult to verify, and diffusion models have become potent instruments for spreading dis- information and manipulating public opinion. For example, during the 2024 U.S. presidential election, U.S. officials accused Russia and other countries of using generative AI to fabricate fake news,
CA2 use Es
015
$50
C7
Diversity (messure by LPIPS soae))
Figure 1: T2SMark strikes an optimal balance between ro- bustness and diversity.
"Coreesponing authors.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

images, and videos to influence voter sentiment and disrupt the electoral proces: Meanwhile, service providers invest vast amounts of data and computing power to train these models and urgently need effective mechanisms to safeguard their intellectual property against unauthorized use. Together, these concerns have increased the demand for robust solutions to protect the copyright and trace the provenance of Al-generated images, making this focal point of current academic research.
To address these challenges, watermarking presents a fundamental solution and has shown consider- able promise. Among various techniques, Noise-as-Watenee Watermark (NaW) methods, including Gaussian Shading (GS) [3] and PRC- -at-eaaermrrk (PRCW) o stand out. At its core, NaW maps watermark codewords onto a standard Gaussian noise vector, uses it as the initial noise for image generation, and thus embeds watermark information while preserving the noise distribution. For extraction, one simply inverts the diffusion process to recover the embedded noise and subsequently decodes it to retrieve the watermark. The reversible bijection offered by the forward and backward diffusion processes between high-entropy Gaussian vectors and the low-entropy image manifold allows NaW methods to achieve high-capacity, lossless embedding for individual images without the need for supplementary training.
The embedding process in most discrete encoding and continuous sampling. The former step converts the watermark message into codewords, while the latter transforms those discrete binary codes into continuous noise. The challenge in discrete encoding lies in balancing the need for randomness, which makes the watermark difficult to predict, with the need for robustness against various distortions - goals that are often contradictory. Continuous sampling, on the other hand, is critical for maintaining imperceptibiliity by precisely preserving the initial Gaussian noise distribution. Current methods make different trade-offs: GS [5] employs simple repetition code for high robustness but lacks randomness, depending entirely on the sampling process for variation. PRCW (6), while using pseudorandom error-correcting code 77] for better undetectability, exhibits weak robustness and can fail when subjected to common inversion errors.
(NaW) methods comprises two core steps:
To overcome these limitations and achieve a balance of both robustness and diversity, we propose T2SMark, a novel two-stage watermarking scheme built upon Tail- Truncated Sampling (TTS). While previous efforts have concentrated primarily on discrete encoding strategies, we observed that Gaussian samples closer to the origin are significantly more vulnerable to sign errors when noise is present. This finding inspired our TTS approach: instead of simple positive/negative mapping for bits, TTS divides the Gaussian distribution into three distinct areas: one for bit-O, one for b and undecided region (see Figure more reliable tail regions, with the central region being sampled randomly to compensate for diversity two-stage framework introduces controlled
0
Prior Methods
Ours
Figure 2: Tail-Truncated Sampling di-
vides the distribution into three regions: bit-O, bit-1 and an undecided zone (0). Information is embedded only within the
and maintain the overall distribution. Additionally, randomness via hierarchical key encryption. A static master key encrypts a randomly generated session key in the first stage, and this session key is then used to encrypt the actual watermark bits in the second stage. This layered encryption randomizes both parts of the watermark codewords, thereby further ensuring the generation diversity. Finally, we improve detection and decoding by employing multidimensional projections of the reconstructed Gaussian noise, allowing us to fully leverage its rich continuous information.
Evaluated on diffusion models [3 8
with both U-Net O and DiT 4 backbones, T2SMark demon- strates an optimal trade-off between watermark robustness and generative diversity.
2
Related Work
2.1 Diffusion Models
Diffussin models [14 iteratively corrupt data by injecting Gaussian noise and train a denoising network to reverse this process. The canonical DDPM framework (1] employs stochastic Markov chain for multi-step sampling, delivering outstanding sample quality at the cost of slow inference.
U.S. officials say Russia embracing Al for its election influence efforts
NPR. September 23, 2024.

---

Building on DDPM, DDIM 2 reformulates the random process as deterministic ODE, transforming sampling into an invertible mapping that both accelerates generation and enables inversion-malle the backbone of many inversion- based watermarking techniques
S
6 10 Moreover, latent diffusion
models (LDMss) 3 first compress high-dimensional data into lower-dimensional latent space and then perform noise addition and denoising in that compact space. This strategy dramatically reduces computation while preserving generation quality and significantly boosting efficiency.
Inspired by the Transformer's success in NLP THE researchers have introduced self-attention into diffusion models. Diffusion transformers (DiTs) leverage the scalability of transformer architectures for image generation. Today. many leading diffusion pipelines g backbones, driving advances in high-fidelity and efficient synthesis.
[4 15]
adopt DiT
Generation diversity is an essential metric for assessing a model's creative capacity. ODE-based samplers 2 16 177 achieve faster inference by discarding stochastic noise during denoising, which means that diversity depends entirely on the initial noise vector. As a result, any watermarking scheme that alters or constrains the initial noise sampling can have direct effect on generation diversity.
2.2 Image Watermarking for Diffuusin Models
Image watermarking methods for diffusion models can be divided into three main categories. 1) Post- processing schemes [18 21 embed a watermark directly into the generated image using either traditional transform-dome domain techniques [8] or deep learning-
methods [19 wwihhout modifying the sampling process. While this preserves model diversity, it inevitably degrades visual quality and provides only limited robustness. 2) Fine-tuning schemes [22] 23) inject watermarks by adapting either the diffusion model's denoiser or, in latent diffusion setup, the VAE (24) backbone; these methods maintain sample fidelity but require costly weight updates as model architectures grow. 3) inversion-bssed schemes [S 6 [0] embed information into the initial Gaussian noise sample and recover it by inverting the diffusion process. This category includes perturbation-bart approaches such Tree-Ring [00 and RingID 225, which adds robust Fourier-domain patterns at the expense of distributional bias, and Noise-ass as- Watermark (NaW) techniques such as Gaussian Shading (GS) and PRC-Waternn Watermark (PRCW) O which use distribution perettioon--reeeiinnnng sampling to achieve high embedding capacity without shifting the noise distribution. Our T2SMark method also falls into this NaW paradigm. Building upon the principles of Tree-Ring, other methods such as ROBIN (26) and ZoDiac (27] focus on ownership detection rather than message embedding. These are 0-bit watermarking schemes, designed solely to verify if an image was generated by specific model. They leverage pradient-based optimization to embed imperceptible signature, achieving impressive fidelity and competitive robustness. However, their design philosophy differs significantly from our approach. By not needing to be strictly identical to unwatermarked original, training-fre free NaW methods can fully leverage the initial noise space to achieve a high capacity (e.g.. 256-bit) for traceability. Given these fundamental differences in goals (detection vs. traceability) and methodology (optimization based vs. training- free), we do not conduct a direct comparison with them in this paper.
Method
3.1 Threat Model
Scenarios. This study considers four key parties: the provider, who operates closed API image generation service maintaining proprietary model weights and training data; the compliant user, who adheres to platform policies and utilizes the outputs legitimately; the unauthorized user, who illicitly obtains images to claim them as their own; and the malicious user, who exploits the API to generate and disseminate harmful or deceptive content.
Detection. The provider embeds single-bit watermark into every image generated and serves through the API. Both compliant and malicious users receive only watermarked outputs, whereas unauthorized users have no means to obtain unmarked images. Even after typical manipulations, such as compression or cropping, our extraction algorithm robustly recovers the embedded watermark bit, thereby furnishing incontrovertible proof of the provider's legitimate copyright while simultaneously signaling the image's 's synthetic origin.
3

---

Traceability. Each API account is uniquely assigned an identity watermark. In instances of misuse, extracting the embedded identity watermark from suspect image (potentially after data augmentation designed to evade tracing) enables the provider to match it against the account database, thus pinpointing the source, deterring unauthorized distribution, and holding malicious actors accountable.
3.2 Overview
Watermark Embedding
2T
19101100.
27
Zg
Watermark b
Encoding
Independen::
Generation
D
Scssion Key Kr
Encoding
Verification
Muster Key
Detection
Decading
Session Key KC;
E
Inversion
Decoding
Watermark
Watermark Extraction
Attack
0.
-03 -44
Watermarked Vector
Random Noise
Combinc
Depart
-10--12
YRNG
PRNG
2T
Sampling
FRNG
(K) for 1st stage
Key
HRNG
{u.
Projection
011108
Key
A (X)) for 2nd stage
011100
Sign
Iell 2 d?
(K) stage
Encoding
Message
(K.) for 2nd stage
Decuding
Message
b
Detection
Figure 3: The framework of T2SMark. Building on the NaW paradigm, Tail- Truncated Sampling enhances robustness while the two-stage structure introduces controlled randomness.
T2SMark can be clearly illustrated by Fig. We first split the noise vector into two segments: the first encodes a random session key under fixed master key, and the second uses that session key to encode the actual watermark bits. Because both segments depend on the random key, the full vector remains randomized.
Formally, in the single-stage setting, we treat the n-dimensional noise space as direct sum of orthogonal subspaces. The key pseudorandomly selects hyperplane through the origin that splits each subspace into two half spaces for binary encoding. During sampling, we employ Tail-Truncated Sampling: points drawn along each hyperplane's normal and kept least distance from the boundary. This thresholding carves out robust watermark-encoon subspace of larger-magun maggituee vectors that resist gross-boundee perturbations, while the remaining dimensions carrying no bits retain randomness.
At extraction, reconstruct the noise via inversion algorithm (2) and project it onto the same set hyperplane normals. Each bit is recovered from the sign of its projection, which identifies the half-space containing the sample, while detection the projection's 's L, measure. This approach fully exploits the continuous structure of the noise vector. The detailed scheme follows subsequent sections.
confidence
3.3 Watermark Encoding
Here, encoding means mapping the watermark into continuous noise vector, not just discrete coding. Let be the initial noise dimension, T 2 the truncation threshold for Tail- Tail-Truuncated Sampling, E IN the watermark length, and b {=1]" the bit-vector.

---

Based on the threshold т, we determine the expected number of tail-sampled dimensions & and the per-bit subspace dimension
2 2 (-
r
k//m],
Using secret key K as the seed for PRNG (Pseudorandom Number Generator), generate set of m pseudorandom vectors {Uş}リ=ı, where each V; E {-1,0, +13", These vectors are designed with orthogonal, non-overlapping supports and serve the normal vectors for the bit-encoding hyperplanes within the watermark embedding subspace:
byylo
supp(e;) (usppep)) (+
Next, we form the binary mask w = سー أر| E f0, 1). This mask partitions the n dimensions into the watermark- encoding subspace (w, = 1) and the random-noise subspace (w, = 0). Tail-Truncated Sampling (TTS) is applied to sample components for the noise vector
(TN(0,1:1-T,7))
0, Wi 1.
where TN o²; I) denotes the normalized truncation of N(u,a") over interval I. The final watermarked noise vector z" is then constructed by combining the signs corresponding to the bits in the tail- tail-sampled dimensions with their magnitudes from while incorporating the random samples from the central dimensions. This is achieved by:
by Uy + (1" w 2)) 22
j=1 bj vj represents the directional encoding of the where ④ is the Hadamard product. The term > m bits b within the subspace defined by {u,}
3.4 Watermark Decoding
Upon reconstructing the watermarked noise 2" via diffusion inversion (2), regenerate the set of vectors {1,} using the same secret key K. The projection vector E IRm is computed by taking the dot product of 2" with each vector Vy:
Pj (2 Uz), for j ,....,m.
The watermark bit-vector is recovered directly from the signs of the projection vector components:
b = sign(p):
where sign(-) is applied elementwise to the m-dimensional vector With per-bit encoding dimension less than [n/m] (indicating reduced repetition), a higher signal-to-ne co-naee ratio (SNR) achieved by TTS, theoretically Icading to an even lower probability of bit error under the AWGN assumption (see Appendix A)
3.5 Two-Stage Watermark
We split the n-dimensional noise into two segments of dimensions ny and nı (with nig + n, = n), often corresponding channelwise partitioning. First, using the master key K, we sample an ny nu-dimensioonal vector x that encodes a random session key K,. Next, with K,, we sample an oo-dimennional vector z containing the watermark bits b. The combined watermarked noise is given by =" = z² =*11²", where (:Il)) denotes vector concatenation.
During extraction, we partition the reconstructed noise 2" into & and d. We first recover K' from ** via the master key K, and then retrieve the watermark b from 2 using K". The session key K, thus serves dual role: embedded payload the first segment and key for the second, injecting randomness across " and preserving generation diversity.
5

---

3.6 Detection and Traceability
Detection relies primarily on the first stage due to the risk of error propagation two-stage decoding. Leveraging the larger norms of projections afforded by TTS, the test statistic is computed based on the L1 norm of the first-stage projection vector:
| (Px), - (z", Uky), 1..,..., my-
(7)
In this equation, my denotes the size of the session key. Ps: is the projection vector obtained by projecting 2x onto the first stage's normal vectors {wky 1 This statistic I is compared against threshold d calibrated to a target false-positive rate.
For traceability, full two-stage decoding is performed to recover the complete embedded bit-vector b. This decoded watermark is compared against the registered identity watermark database. The account whose assigned watermark yields the highest similarity score (e.g., match count or Hamming distance) is identified as the image's originator, enabling misuse tracing and accountability.
4 Experiments
4.1 Experimental Setup
Implementation Details. Our image generation backbone is Stable Diffusion v2.1 (SD v2.1) [. configured with a guidance scale of 7.5, 50 DDIM denoising steps, and fixed 512 x 512 output resolution. T2SMark employs 16-bit session key and bit watermark. We set the truncation threshold 0.674. The session key is embedded in the first channel of the initial noise. This is determined empirically in our parameter selection study (see Appendix B..).. All the experiments are implemented in PyTorch 2.4.1 and run on single NVIDIA RTX A6000 GPU.
Baselines. We compare against three categories of existing methods. Traditional post-processing
transforms include dwtDet (18), dwtDettvd [18], and the learning- -ased RivaGAN [19]; fine-tuning approaches are represented by Stable Signature [2]]: Inversion- based Schemes include Tree-Ring (TRW) [10], Gaussian Shading (GS) [5] and PRC- Watermark (PRCW) (6). For all inversion-base methods, we perform 10-step DDIM inversion [2]. During inversion, we employ an empty prompt and fix the guidance scale
Ring
simulate unknown prompt conditions. To ensure fair capacity, det dwtDeetvdd Gaussian Shading, and PRC-Watermart all embed 256 bits. RivaGAN and Stable Signature use 32 bits and 48 bits respectively, following their official implementations.
Evaluation. We evaluate on MS-COCO-2017 28 dataset (COCO) and Seaile-DDffusoo--PPPe dataset (SDP). For robustness, we compare the TPR at fixed FPR 10-6 in the detection setting and per-bit accuracy in the traceability setting. For each method, we sample 500 prompts from the SDP training split, generate 500 watermarked images, apply nine different distortions (see Figure 4. and then perform detection and traceability.
We assess generation diversity via LPIPS 29). For each con-post-processiie method, we generate 10 images for each of 1,000 COCO test prompts with a fixed master key and watermark, compute LPIPS over the 45 unique pairs per prompt, and report the overall mean. Post-processing methods leave the core generation unchanged and are therefore omitted from this evaluation.
For visual quality, we report the CLIP score 330 and FID (1I. We run 10 independent trials: in each trial, fix a single key-watermark pair (simulating one user), and generate 000 images from COCO's test prompts for the CLIP score and FID. We then perform two-sample (-tests to assess the impact of the watermark on quality. The hypotheses are Ho Ms = μo, H1 : μs # po, where p. and μo denote the mean FID or CLIP score computed over multiple sets of watermarked and clean images, respectively. A lower t-value indicates stronger support for Ho. Details about the t-test can be found in Appendix B.3
4.2 Main Results
Results for the different methods are presented in Table T2SMark demonstrates superior perfor- mance in the traceability scenario while achieving detection performance comparable to the best
Siabbe-Diffusion-tee Diffusion-Prompts

---

a8)
(b)
(c)
(d) (e)
(f)
R
(h)
(I)
Figure 4: The watermarked image is attacked by different types of noise. (a) Watermarked image.
(b) JPEG, QF 25. (c) 60% area Random Crop (RandCr). (d) 80% area Random Drop (RandDr).. (e) 25% Resize and restore (Resize). (f) Gaussian Blur, 4 (GauBlur). (g) Median Blur, k = 7 (MedBlur). (h) Gaussian Noise, 0, o 0.05 (GauNoise). (i) Salt and Pepper Noise, p = 0.05 (S&PNoise). (i) Brightness, factor = 6.
Table 1: Evaluation results of watermarking methods, including detection (TPR), traceability (Bit Acc.), generation diversity, and visual quality (CLIP score and FID). TPR and Bit Acc. are shown as Clean/Adv. Standard errors and t-values are shown for the CLIP score and FID.
Method
TPR
Bit Acc.
Diversity f
CLIP Score (f ()
FID (8 J)
SD v2.1
0.7072
0.3224=0.0010 (-)
56.8132::0:48 (-)
dwiDet
18
0.922/0.173
0.8177/0.5744
0.5206=0000100 (3.7233)
56.3471+H0448 (2.0270)
dwitetSSvd
18
1.000/0.471
0.9988/0.6808 6800
0.3209=0.0010 (3.2150)
56.098610:48 (3.1220)
RivaGAN 19
0.914/0.436 0.9823/0.8666 8666
1.3209::000010 (3.2150)
16.1883:10.44 (2.7332)
StableSig
222
1.000/0.418 00.981/
0.6917
0.3235=0.0007 (2.6063)
56.0423++0.38 (3,7020)
TRW [10
10000/0900
-/-
0.6943
0.3210=0.000
(3.6365)
58.2667-+0.36 (6.9293)
GS 5
1.000/0.998
1.0000/0
9548
0.6446
0.3242=0.002 0027 (1.7557)
58.1377#1. 19 (3.0807)
PRCW 6
1.000/0.29.
0,6494/0.5022
50244
0.7074
0.3218 000088000000 (1 (1,4369)
56.8975 0.,38 (0.4056)
T2SMark
1.000/0.998
1.000000.9754
0.7069
0.3227=0.0000 (0.5081)
56.9317+:042 (0.5490)
In contrast, PRCW 6 performs worst in traceability and registers detection TPR below 30% under adversarial conditions, which is too fragile for real-world deployment. More detailed robustness results under various noise types can be found in Appendix B.4
method, GS 15
B.4
PRCW achieves the highest score. representing a negligible gap. GS exhibits the lowest diversity score, which attributable to use fixed codeword for each user, while Stable Signature and TRW also experience noticeable reductions in diversity.
With respect to generation diversity, measured by LPIPS 29
T2SMark trails closely behind, with difference of less than 10 -3
Regarding image quality, only T2SMark and PRCW consistently satisfy the no-degradation criterion across both evaluation tests. Although GS achieves a competitive CLIP score (30), its FID [31] deviates significantly from the no-watermark baseline. Furthermore, GS exhibits noticeably larger standard deviation in the CLIP score and FID, suggesting that its generation quality is sensitive to the specific watermark and key used. This sensitivity poses a challenge for the user experience, potentially leading to inconsistent generation quality when different user accounts (with different watermarks/keys) are involved. Considering all the evaluated metrics, T2SMark achieves the best overall balance.
4.3 Undetectability
To evaluate watermark undetectability, we trained ResNet- 18 classifier 32 to distinguish between watermarked and watermared images. We assessed four inversion-based methods using fixed key and watermark for each. The training set for each method consisted 8,000 watermarked and 8,000 clean samples, while the test set contained 500 samples each. Training was conducted for 10 epochs with batch size of 128 and learning rate of 10-1, Table reports the test
reports accuracy. The results indicate that TRW [10 and GS [ are relatively easy detect. Although
7

---

PRCW [6] demonstrates the highest level of undetectability, we observe that it is not entirely immune detection. T2SMark achieves the second-best performance and can also be considered difficult to detect, demonstrating high level of impercepribilityy
Table Undetectability of different inversion- -based watermarking methods, measured by detection accuracy (Det. Acc.). A lower accuracy indicates better undetectability.
TRW 10
GS 5
PRCW 66
T2SMark
Det. Acc.
0.971
0.994
0.532
0.578
4.4 Generalizability
We evaluate T2SMark along with other inversion-based watermarking methods on the Stable Diffusion v3.5 Medium model (SD v3.5M) [8], which employs DiT 4 as its denoising network and features 16-channel latent space. The detailed settings can be found in Appendix B.1
The results in Table show that SD v3.5M delivers superior generative quality so that all methods maintain strong visual fidelity. TRW's robustness declines markedly compared with its performance on SD v2.1, 1, and GS experiences a similar loss of diversity. PRCW improves traceability but still trails the best method by a wide margin. In contrast, T2SMark achieves the best balance of robustness and diversity, and its undetectability is virtually indistinguishable from that of PRCW.
Table 3: Evaluation results of inversion-based watermarking methods on SD v3.5M, including detection (TPR), traceability (Bit Acc.), detection accuracy (Det. Acc.), generation diversity, and visual quality (CLIP score and FID). The TPR and Bit Acc. are shown as Clean/Adv. Standard errors and v-vlus are shown for the CL.P score and FID.
Method
TPR
Bit Acc.
Det. Acc.
Diversity 1
CLIP Score (1 ()
FID (1. 4)
SD v3.5M
-/-
0.6113
0.3498# 0010 (-)
55.7627=.56 (-)
TRW 10
0.318
0.5924
0.34934.000 (1,3493)
55.90844.53 (0.5699)
GS S
1,000/ / 0.990
0.9994 / 0.9663
0.991
0.5176
0.35021.0004
(0.9943)
56.20201167 (1.5043)
PROW 6
0.998 0..799
0.9920/ / 0.6067
0,516
0.6096
0.35024.0005 (0.9726)
55.56734.49 (0.7902)
T2SMark
1,000/ 0.985
1.0000/
0.9768
0.518
0.6102
0.34991.0004 (0.0991)
55.81211.49 (0.1983)
4.5 Ablation Study
In this section we conduct ablation experiments SD v2.1 evaluate robustness under varying hyperparameter settings. Unless otherwise specified, we generate 500 images on the SDP dataset and report the true positive rate at fixed false positive rate of 10-6 alongside bit accuracy.
Tail- Truncated Sampling. We evaluate T2SMark both with and without Tail- Truncated Sampling (TTS), and additionally measure generation diversity over 1,000 prompts from the SDP dataset. The results in Table T demonstrate that TTS provides a substantial robustness boost while having only a negligible effect on diversity. This confirms TTS as critical component of T2SMark.
Table 4: Performance of T2SMark both with and without Tril-Truneated Sampling.
TPR (Clean/Adv.)
Bit Ace. (Clean/Adv.)
Diversity t
w/o TTS w/ TTS
1.000/0.996
0.9988/0.9307 1.0000/0.9754
0.6743
1. 1.000/0.998
0.6746
Noise Intensities. To further test the robustness, we conduct experiments using different inten- sities of noise. The results are shown in Figure Figure(jaii), T2SMark is highly vulnerable to Gaussian noise-even at a low noise standard deviation of 0.1, its performance degrades dramatically, weakness that has also been reported in experiments of other inversion-based methods [0].

---

I7A0 1-0 AURIIN
E 2
144
77P
T7A
17S
77R
7PC
(x) IPR0
(b) Rardlin Crop
(c) Randimn Deop
(43 Restze
(c)Cuusei Blar
170 D7 Aer
obo
0d6
1/le
SeaderD Couesion Notse
Middan Lshrr
Salt Noise
Brighttess
Otidanoe Scale
Figure 5: Ablation Studies.
Guidance Scales. Given diverse user preferences for prompt adherence, higher guidance scales enforce the original prompt more strictly, while lower scales allow greater creative freeddo. Since Stable Diffusion v2.1 typically uses guidance scales between and 15, our experiments span wider range of 2-18. As shown in Figure 5()). T2SMark's performance degrades only marginally under these settings.
Inversion Steps. We evaluate T2SMark with 5, 10, 25, 50, and 100 inversion steps (Table and observe only minor performance fluctuations. Therefore, directly improves the extraction efficiency by reducing the number of inversion steps, as inversion the primary bottleneck in NaW extraction pipelines.
Table 5: Impact of inversion steps on robustness performance. The TPR and Bit Acc. are shown Clean/Adv.
Table 6: Performance under different ca- pacity settings. The Bit Acc. is shown as Clean/Adv.
Inversion Steps
TPR
Bit Acc.
Capacity (bits)
Bit Acc.
5
1.000/0.996
1.0000/0. 9700
256
1.0000/0.9755
10
1.000/0.997
1.0000/0.9760
384
1.0000/0.950
25
1.000/0.996
1.0000/0.9764
512
1.0000/0.944
50
1.000/0.99) 1.0000/0.9745
768
0.9992/0.9 9145
100
1.000/0.997
1.0000/0.9730
1024
0.9968/0.8789
Watermark Capacity. We evaluate T2SMark using watermark capacity of 256, 384, 512, 768 and 1024 bits 6T. As expected, the robustness of T2SMark degrades with increased capacity. However, if the actual noise level in deployment is lower than that used in our experiments, a moderate increase in capacity remains tolerable.
Table 7: Performance under different session key sizes.
8
24
32
TPR (Clean/Adv.)
1.000/0.999 1.0000/0.9776
1.000/0.993 1.0000/0.9754
1.000/0.996 1.0000/0.9687
1.000/0.99/ 1.0000/0.9481
Bit Ace. (Clean/Adv.)
Session Key Size. We evaluate T2SMark via random key sizes of 8, 16, 24, and bits (Table As the length of the random key increases, it becomes more difficult to extract the key perfectly in the first stage, which leads to cascading errors and rapid drop bit accuracy. While longer keys can theoretically enhance randomness, we find that 16-bit key provides sufficient entropy for practical use-since it unlikely that single user would generate number of images large enough to exhaust this space. Moreover, with 32-bit random key, T2SMark still maintains acceptable robustness.

---

Limitations
Despite its wonderful performance on diversity and robustness, T2SMark subject to several limitations. A key set of challenges is shared among most NaW methods. First, the high robustness that allows for watermark recovery can be exploited in forgery attack. An adversary could use proxy model to invert the diffusion process, recover the watermarked noise vector, and then use this vector to generate new, forged images that appear authentic because they carry valid watermark 33 Second, T2SMark, like other NaW schemes, depends on an invertible, ODE-based sampling method (c.g.. DDIM 12). SPM-Solver (I6). Without such a sampler. the initial noise cannot be reconstructed, preventing watermark recovery and limiting applicability to diffusion models that support this feature. Third, NaW methods are vulnerable to geometric distortions since their designs lack explicit mechanisms to resist it. Recent work like GaussMarker (34] offers effective solutions to this. Finally, there a potential conflict with certain controllable generation methods that require modifying the sampling logic, as this could interfere with the watermark embedding and detection process. In addition to these shared challenges, T2SMark has unique vulnerability stemming from its key embedding strategy: Embedding the session key in the truncated tails concentrates energy in way that introduces subtle distributional anomalies, which can be detected.
Conclusion
T2SMark presents a novel watermarking framework for diffusion -enerirte images. leverages Tail- TrilcTruneeted Sampling (TTS) to increase robustness and employs two-stage key hierarchy to introduce controlled randomness and support generation diversity. Experiments on both the U-Net [9] and DiT [ architectures demonstrate that T2SMark achieves superior traceability and competitive detection performance while effectively preserving diversity and image quality.
Acknowledgments
This work was supported in part by the National Natural Science Foundation of China under Grant 62472398, Grant U2336206, Grant U2436601, and Grant 62402469.
References
[1] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models, In Advances Neural Information Processing Systems, pages 6840-6851. Curran Associates, Inc., 2020.
[2] Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In International Conference on Learning Representations, 2021.
[3] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björ Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages (0684-10695 June 2022.
[4] William Peebles and Saining Xie. Scalable diffusion models with transformers. In Proceedings of the IEEE/CVF International Conference Computer Vision (ICCV), pages 4195-4205, October 2023.
[5] Zijin Yang. Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shading: Provable performance-lossles, image watermarking for diffusion models. In Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 12162-12171, June 2024.
[6] Sam Gunn, Xuandong Zhao, and Dawn Song. An undetectable watermark for generative image models, arXiv preprint arXiv:2410.07366, 2024.
[7] Miranda Christ and Sam Gunn. Pseudorandom error-correcting codes. Advances in Cryptol- ogy CRYPTO 2024, pages 325-347, 2024.
10

---

[8] Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müllrr, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, al. Scaling rectified flow trans- formers for high-resolution image synthesis. In Forty-forst international conference on machine learning, 2024.
[9] Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomedical image segmentation. In Medical image computing and computer-assisted intervention- 2015: 18th international conference, Munich, Germany, October 5-9, 2015, proceedings, part III 18, pages 234-241. Springer, 2015.
[10] Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust. arXiv preprint arXiv:2305.20030 2023.
[11] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention all you need. Advances in neural information processing systems, 30, 2017.
[12] Jacob Devlin, Ming- Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 conference of the North American chapter of the association for computational linguisties: human language technologies, volume (long and short papers), pages 4171-4188 2019.
[13] Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D) Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models few-shot learners. Advances in neural information processing systems, 13:1877-1 2020.
[14] Yixin Liu, Kai Zhang, Yuan Li, Zhiling Yan, Chujie Gao, Ruoxi Chen, Zhengqing Yuan, Yue Huang, Hanchi Sun, Jianfeng Gao, et al. Sora: A review background, technology, limitations, and opportunities of large vision models. arXiv preprint arXiv:2402. /7177, 2024.
[15] Junsong Chen, Jincheng Yu, Chongjian Ge, Lewei Yao, Enze Xie, Yue Wu, Zhongdao Wang, James Kwok, Ping Luo, Huchuan Lu, al. Pixart- aalph: Fast training of diffusion transformer for photorealistic text-to-image synthesis. arXiv preprint 1xXiv:2310.00222
2023.
[16] Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan LI, and Jun Zhu Dpm-solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps. In Advances in Neural Information Processing Systems, volume 35, pages 5775-5787, 2022.
[17] Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm- solver++: Fast solver for guided sampling of diffusion probabilistic models. arXiv preprint arXiv:2211.01095 2022.
[18] Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker. Digital watermarking and steganography. Morgan kaufmann, 2007.
[19] Kevin Alex Zhang. Lei Xu, Alfredo Cuesta- Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. arXiv preprint arXiv:1909.01285, 2019.
[20] Zhaoyang Jia, Han Fang, and Weiming Zhang. Mbrs: Enhancing robustness of dnn-based watermarking by mini-batch of real and simulated jpeg compression. Proceedings of the 29th ACM International Conference on Multimedia, page 41 41-49, 2021.
[21] Rui Ma, Mengxi Guo, Yi Hou, Fan Yang, Yuan Li, Huizhu Jía, and Xiaodong Xie. Towards blind watermarking: Combining invertible and con-invertible mechanisms. In MM '22, page 1 1532-1542, 2022.
[22] Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The sta- ble signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEF/CVF International Conference on Computer Vision (ICCV), pages 22466-22477, October 2023.
[23] Rui Min, Sen Li, Hongyang Chen, and Minhao Cheng. A watermark-conditionn diffusion model for ip protection. In European Conference on Computer Vision, pages 104-120. Springer, 2024.
11

---

[24] Diederik P Kingma, Max Welling, et al. Auto-encoding variational bayes. arXiv preprint 132.v:1312.6114, 2013.
[25] Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification. In Proceedings of the European Conference Computer Vision (ECCV), page 338-33- 2024.
[26] Huayang Huang. Yu Wu, and Qian Wang. Robin: Robust and invisible watermarks for diffusion models with adversarial optimization. Advances in Neural Information Processing Systems, 37: 3937-3963, 2024.
[27] Lijun Zhang, Xiao Liu, Antoni V Martin, Cindy X Bearfield, Yuriy Brun, and Hui Guan. Attack-resilient image watermarking using stable diffusion. Advances in Neural Information Processing Systems, 017:38800-88000 2024.
[28) Tsung-Yi Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer vision-ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, proceedings, part 13, pages 740-755. Springer, 2014.
[29] Richard Zhang, Phillip Isola, Alexei Efros, Eli Shechtman, and Oliver Wang. The unrea- sonable effectiveness of deep features perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 586-595, 2018.
[30] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pages 8748-8763. PmLR, 2021.
[31] Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems, 30, 2017.
[32] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for im- age recognition. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition (CVPR), June 2016.
[33] Andreas Müller, Denis Lukovnikov, Jonas Thietke, Asja Fischer, and Erwin Quiring. Black-box forgery attacks semantic watermarks for diffusion models. arXiv preprint arXiv:2412.03223, 2024.
[34] Kecen Li, Zhicong Huang, Xinwen Hou, and Cheng Hong. Gaussmarker: Robust dual-domain watermark for diffusion models. arXiv preprint arXiv:2506. 1444, 2025.
[35] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large- scale hierarchical image database. In 2009 IEEE conference computer vision and pattern recognition, pages 248-255. Ieee, 2009.
[36] Xingchao Liu, Chengyue Gong, and Qiang Liu. Flow straight and fast: Learning to generate and transfer data with rectified flow. arXiv preprint arXiv:2209.0300 03003, 2022.
12

---

A BEP Analysis under Tail-Truncated Sampling
We model decoding binary decision under additive white Gaussian noise (AWGN) with variance o². Owing to the symmetry of the problem, we analyze the case corresponding to the transmission of bit without loss of generality. Let μ(() and D(r) represent the mean and variance of standard normal variable truncated in [T, +00). Aggregating r truncated samples yields test statistic with an effective signal-to-noise ratio
V(T
S(r) = VD(T) 0²
r == (20(-))mmm) ~= 222((-7) n/m.
(8)
In practice we approximate S(r) by
A(T) 1 (T) (((-))((T)
22/m
(9)
VD(T) + 0
and the corresponding bit-error probability is
Pe(t) = Φ (-A())),
(10)
where (--) is the standard normal CDF. For tail-truncated Gaussian distribution,
o( x--)) (-
((T) EEZZ
D(T) Var 2 > 7| =|+ p(T)?
(11)
where (()) is the standard normal PDF
To assess whether the truncation's SNR gain outweighs the redundancy loss for small r > 0, define
o(-T)
B(r)
C(T) VD(T) +
(12)
((T)))
Then A(T) = a B(T) ((T) and
PT(() = - - (-(())) A'(T), = =())= B())
First, at r =, 0,
B(0)- (0)
1/v2T 1
0,
(13)
(8(1)
V1/2
VT
1
C(O) = / D(0) 0²
>0,
(14)
since D(0)= 2 0 and 0² 0. Next,
d
2(0)2 v2
(1) dr
[d( (T) 1 (0-))-1/3 r=
> 0,
(15)
((038/2
2π
(0) dr [ó(- 21 (0-)) 6(0) 2
d
0,
(16)
4(0)2 π
D'(0) = (ę(T) (T) 2 (()) (-) V
2
1 4
< 0.
(17)
Since C'(r) = - (D(T) + 0/) 3/2 (1()), and from 14p and we have
C²((0) - (D(0) + 02) 3/2 D²(
(18)
>0
<0
Combining 13
14p
15 and 18 the product rule for A'(7) gives
A((0) = a B' (1)()) C(0) +
C') > 00 P((0) = -o(((((()) A'(0) < 0.
(19)
>0
20
This analysis, following the provided equations, demonstrates that under the AWGN model, initiating truncation (i.e. using small threshold 7 > 0) strictly decreases the bit-error probability. Although this model an idealization, it predicts the existence of an optimal threshold т, whose value typically determined empirically, as discussed in Section B.2
13

---

B Experimental Details and Additional Experiments
B.1 Implementation Details
Experiments on SD v2.1. In these experiments, 512 x 512 images with a guidance scale of 7.5 and 50 DDIM denoising steps [2] into which we embed watermarks. For dwt vw 18] and RivaGAN [19] we employ the implementation
Stable Diffusion v2.1 to generate
from the GitHub repository Stable Signature [22]. TRW [O]. GS [5], and PRCW [6] are run via their official GitHub codes. We fine-tune Stable Signature for 100 steps with a batch size of 4 on 400 images from the ImageNet2014 4 validation set [35]. Since TRW is single-bit scheme, we evaluate only in the detection setting, using its robust Ring mode in channel 3 as recommended. GS used with its default paper settings, and PRCW is configured for 256 bit capacity. RivaGAN and Stable Signature retain their original capacities of 32 and 48 bits, respectively higher capacities generally worsen extraction performance and image quality. However, none of these methods surpass T2SMark even under these generous capacity settings.
Experiments SD v3.5M. To assess the generalizability of our proposed T2SMark, evaluate it alongside other inversion-basee watermarking methods on the Stable Diffusion 3.5 Medium model (SD v3.5M) (8) SD v3.5 adopts a Rectified Flow training objective (36), operates in larger 16- channel latent space, and leverages the more scalable DiT transformer architecture. Because it also employs ODE-based sampling, inversion-basee watermarking methods can be adapted to it directly. For robustness, we generate watermarked images for 500 prompts from the SDP training set with guidance scale 7.5; for image quality, we sample the COCO test set [28] with guidance scale of 4.0 to emphasize diversity. All methods use 40 inference steps and 10 inversion steps. Embedding occurs in the 16-channel latent space: for TRW and T2SMark's first stage we use the first four channels; GS uses fch 4, fn = 8, and f = 8 (256-bit bit capacity); and PRCW and T2SMark both embed 256-bit bit watermark. T2SMark further employs a 16-bit random key, as in our SD v2.1 setup.
B.2 Parameter Selection
Threshold т. We select r by generating 256-bit, single-stage watermarks on 100 non-overlapping SDP prompts, applying distortions, and measuring bit accuracy. As shown in Table bit accuracy first. increases rapidly with 7 and then slowly decreases. To balance robustness without over-constraining sampling, we choose r -- I6 2 0.674.
Table 8: Bit accuracy under different truncation thresholds T.
+
+ (
+ (
((A)
+ ((t)
Bit Acc.
0.9447
0.9828
0.9873
0.9860
0.9868
0.9855
0.9804
0.9600
Table 9: Post-distortion inversion MSE and detection accuracy (Det. Acc.) by channel.
Channel
0
2
3
MSE 1.
0.8018
0.7815
0.8349
0.8352
Det. Acc. +
0.578
0.612
0.633
0.553
Embedding Channel of the Session Key. Different latent channels exhibit varying inversion errors and detectability. We measure the post-distortion inversion MSE and detection rate for channels 0-3 on the same dataset. As Table shows, Channel achieves the lowest MSE but easily detected, while Channel 3 has the lowest detection rate but higher error. We therefore select Channel 0 to balance underectability and reconstruction fidelity.
14

---

B.3 Details about the t-test
For evaluating the CLIP score 30 and FID 31 we generated n, = no 10 image sets for two-sample t-test. We test the hypotheses
Ho μsx = No:
H1 Ms + No:
(20)
where μt and μl denote the mean metric values for watermarked and clean images, respectively. The (-statistic is computed as
114- Hol 1
[n, 1)52 + (no 1).5%
S"
(21)
n4 + no 2
where S, and So are the sample standard deviations. A lower f-value supports Ho. while >> fo.05, no 2 10.05.18 2.101 leads us to reject H, and conclude that watermarking significantly affects model performance. Otherwise, we consider the watermark to be distortion-free.
B.4 Detailed Results of Robustness Evaluation
We report robustness evaluation results SD v2.1 against various noise types in Table 10 with corresponding results on SD v3.5M in Table[TT] T2SMark consistently outperforms all competing methods across nearly every distortion. Its single notable weakness is Gaussian noise, which likely arises because the inversion process is especially sensitive to this perturbation an effect also observed in other inversion-based schemes (5] 10]. Cascading errors of the two-stage framework exacerbate this vulnerability, causing T2SMark to incur a greater performance decline under Gaussian noise.
Table 10: Detection (TPR) and traceability (bit accuracy) results for watermarking methods on SD
v2.1 under various noise distortions. Values are shown as TPR/Bit Acc.
Noise
dwiDet
[8
dwiDetSvd
[X]
RivaGan 19]
StahleSig 22
TRW IM
GS
PRCW 6
T25Mark
None
0.922/0.877
1.00/0.9988
0.914/0.9823
1.000N0.9981
1.000-
1000/1.0000
1,0000.666
1. L000010000
JPEG
0.0000.5015
0.002/0.522 5225
0. 15000 8091
0.384X0.7922
0.678/-
40000.99994
0.448/0.5017
I. 1.00000.9001
RandCr
0.986/0.7675
0,99800.7833
0.762/0.9476
1.99HN0.9873
0.980/-
1000009422
0,078/0.4985
1. 1.0000.9935
RandDr
0.010006012
0.0000.6188
0.700/0.935
0.98480.9714
0,982/-
L000/0.9156
0.052/0.5004
1. 1.9000,98955
Resize
0.0000.5159
0.982/1.830
0,740/0 9442
0,00680.5130
0.998/
1.0000.989
0.5600149983
1.000009963
GauBlur
0.0000.5029
0.352/0.6311
0.194/0.177
0.001N1.4104
L000/0.966
0.0700044991
L.000009890
MedBlur
0.0000.5251
0.998/0.11
0.780/0-9516
0.00080.6511
0.982/-
1,0000 9945
0.748/144997
1. 1.00000. 909440
GauNoise
0.318/0.6236
0.8500.7807
0.250/0.7948
0.45841.760
0.758/
0.9669099044
0.054/0.4985
0.99411.996
S&PNoise
0.114/0.5878
0.0000.5166
0.082/0.7991
0.076N.7020
0,948/-
L0000093447
0.072X0.4992
0.992N0.9456
Brightaess
0.132/0.5439
0.06000.2241
0.266/08000
0.86680.915
0 0.856/-
0.992/0.970
0.560/0.5259
0,99440
(ave)
0.173/0.5744
0.471/0.6800
0.432/0.6666
0.418NU.7462
0.998/0.9548
0.294/0.5024
0.998%09754
Table Detection (TPR) and traceability (bit accuracy) results for watermarking methods on SD v3.5M under various noise distortions. Values are shown TPR/Bit Acc.
Noise
TRW[IO)
GS [5]
PRCW (6]
T2SMark
None
0.878 /- 1.000 / 0.9994
0.998 / 0.9920
1.000 / 0.9998
JPEG
0.050/-
0.998 / 0.9868
0.312 / 0.5968
0.998 / 0.9955
RandCr
0.596/-
0.998 / 0.9894
0.482 0.6641
0.998 / 0.9989
RandDr
0.822/-
0.992 / 0.9694
0.474 0.6597
0.998 / 0.9955
Resize
0.030
0.998 0.9843
0.170 0.5596
0.998 / 0.9972
GauBlur
0,098 /- 0.994 / 0.9487
0,004 / 0.5017
0.998 / 0.9790
MedBlur
0.004 /- 0.998 / 0.9923
0,250 0.5993
0.998 / 0.9983
GauNoise
0.410/-
0.946 / 0.8832
0,038 / 0.5111
0.886 / 0.8629
S&PNoise
0.738
0.996 / 0.9528
0.026 0.5057
0.996 / 0.9664
Brightness
0.116/-
0.994 / 0.9898
0.756 / 0.8619
0.998 / 0.9978
Adv. (ave)
0.318/
0.990 / 0.9663
0.279 / 0.6067
0.985 / 0.9768
B.5 Results on Different Datasets
To avoid iettaset-nndueed bias, we evaluate watermarking methods on two distinct datasets. Robustness is measured on the COCO dataset 228. while image quality and generation diversity are assessed on the SDP dataset. Since SDP provides no ground-truth references, the FID cannot be computed; therefore, we report only the CLIP score and LPIPS diversity. The results are summarized in Table 12
15

---

Table 12: Additional evaluation results of watermarking methods, including detection (TPR), trace- ability (Bit Acc.), generation diversity, and visual quality (CLIP score). TPR and Bit Acc. shown as Clean/Ady. Standard errors and t-values are shown for the CLIP score.
Method
TPR
Bit Acc.
Diversity 1
CLIP Score (t L)
SD v2.1 3
0.6756
0.3357:.00088(-
dwtDet [18]
0.938/0.176
0.8493/0.5674
0.33471.000/2..9012)
dwtDetSvd [8
1.000/0.472
0.9998/0.6739
0.32899H.0004((12..1)
RivaGAN [9
0.980/0.511
0.9951/0.8829
0.3324H.0009(8.599))
StableSig [22
0.998/0.404 0.9965/0.7422
0.6667
0.8327+..0009(774779)
TRW [I0
1.000/0.892
+-
0.6655
0.33951.0007(10.139)
GS [5]
1.000/0.997
1.0000/0.9639
0.6156
0.33544.0033(0.2222)
PRCW 6
1.000/0.450
0.7956/0.5500 5068
0.6747
0.3352:..0006(14729)
T2SMark
1.000/0.996
1.0000/0.9789
0.6746
0.33111.00120033644
B.6 Details about Evaluation of Undetectability
To assess undetectability. we fine-tuned a pretrained ResNet-18 [32 classifier. For each inversion- based watermarking method and an unwatermarked Stable Diffusion baseline, generated 8,500 images from the SDP training vet-8,000 for training and 500 for testing. The semantic content was controlled with fixed prompt set so that the classifier could not exploit content differences. All the watermark methods use a fixed key and watermark across images. Figures 66 and reeppectively show the training loss and test accuracy over epochs on SD v2.1 and SD v3.5M. TRW [IO] and GS [5] easily detected, while PRCW [6] and T2SMark achieve only marginal detection accuracies just above 50%. Notably, PRCW is not completely immune detection, with test accuracy that consistently greater than 50%. T2SMark performs better on SD v3.5M, indicating that the diffusion model itself critically impacts undetectability. Purely cryptographic undetectability may over-constrain the encoding and sacrifice robustness.
100
0.159
Gaussian Stading
0.7
PRC Watermark
T25Mork
00
0.6
90
90
Tus Aue (9))
Taan Look
0.100
Tah
Taln
Auc
0.50
70
70
0.2
0.1
0.3
3.0
0.000
10
0.0
10
50
0.2
Figure 6: Training Loss and Test Accuracy over Epochs SD v2.1.
100
Causs Shuding 100
WeccWattematt
100
T23Mainc
100
0.25
3.4
to
0.20
+
Las
Est Aox (96)
Text AcE 0h
Thsh Loux
Thain Loss
Thiin Loss
Trah Lows
Tren
Tes" Ace
Teal Acc
Taxt Acc
0.
9.3
50
60
10
10
Epoch
Epoch
Tpech
Epachh
Figure 7: Training Loss and Test Accuracy over Epochs on SD v3.5M.
B.7 Detailed Results of Ablation Studies
Tables 13 14 and
15 present detailed ablation results for the inversion steps, watermark capacity and session key size. Within practical ranges, our method supports flexible adjustment the embedding inciuii-nicluuing the session key size-withou altering any other parameters, making it well
16

---

suited for real-world deployment. Because diffusion models allow users to select image resolutions freely, our scheme naturally accommodates different resolutions without additional tuning, whereas methods such as GS [ require modifying the diffusion factor, which can be cumbersome.
Under adversarial distortions, observe slight decline in bit accuracy the number of inversion steps increases. We attribute this to complex interactions between certain perturbations, such as brightness changes, and the inversion process.
Table 13: Robustness evaluation T2SMark across different inversion steps, shown as TPR/Bit Acc.
Noise
25
50
100
None
1.000/1.0000
1. 1.000/100000
1.000/1.00 .0000
1.000/1.000 10000
1.000/1,000 1,0000
JPEG
1. 1.00000.9888
1.000/0.9900
1. 1.00000.90 9904
0000/0.9899
1.000/0.987 9879
RandCr
1. 1.000/0.8899
1.000/0.99 9934
1.000/0.900 9999
1.000/0.8557
1.000/0.98
RandDr
1.000/0.9851
1. 1.00000.9001
1.00000.9873
1.000/0.8836
1.000/0.979)
Resize
1.00000.9555
1. 1.0000099633
1.000009969
1.000/0.9688
1.000/0.9967
GauBlur
1.000/0.9835
1. 1.000/0.988 9890
1.000009876
1.000/0.988
1.00/0.9867
MedBlur
1.000/0.998 9982
1.000/0.900 9094/
(000/0.998)
0000/0.9981
1.000/0.9982
GauNoise
0.972/0.8849
0.986/0.9018
0.976/0.9077
0.992/0.9062
0.984/0.9034
S&PNoise
0.996/0.9373
0.996/0.9482
0.998/0.9530
0.998/0.9504
1.000/0.9535
Brightness
0.994/0.9741
0.992/0.9803
0.990/0.9760
0.990/0.9728
0.990/0.9699
Adv. (ave)
0,996/0.9708
0.997/0.9764
0.996/0.9764
0.998/0.9745
0.997/0.9730
Table 14: Bit accuracy of T2SMark water- mark extraction across different embedding capacities.
Table 15: Robustness performance of T2SMark wa- termark with different random key sizes, shown as
TPR/Bit Acc.
Nošse
256
384
512
768
1024
Noise
8
16
24
32
None
1.0000
0.9999
0.9999
0.9992
0.9968
None
100000.9999
1,000/1 .0000
1.00011 .0000
1.00000
JPEG
0.9901
0.9766
0.9648
0.9381
0.9107
JPEG
1.000099900
1.00U00. 9901
1 .0000/ 9899
L.00N0,9970
RandCr
RandCr
1.0000.9935
RandDr
0.9895
0.9774
0.9488
0.9236
0.8425
RandDr
L00000.8997
100000.9899 98995
1.000..00 9880
1.00N0.97877
Resize
0.9963
0.9900
0.9816
0.9585
0.9352
Resize
L000/0.9966
1.00L0099633
.00000.9973
1.00UN. 1.000N0.9430
GauBlur
0.9889
GauBlur
100000.9868
1,00000. 9890
00000.9860
1.00000.776
McdBlur
0.9984
0.9929
0.9878
0.9692
0.9482
MedBlur
1. 1.000099980
1.00U00 9994
1.000099998
1.00XK] 9982
GauNoise
0.8961
0.8487
0.8123
0.7744
GauNoise
0.994/0.9113
0.994/0.58
0.940N0.8122
S&PNoise
0.9456
0.9147
0.8960
0.8547
0.8205
S&PNoise
0.998/0.9512
0.992/0 9456
1.0000.9344
0.99880.8802
Brighrness
0.9803
0.9628
0.9509
0.9287
0.9056
Brightess
0,990/0.9803
0.992/0.9803
0.986/0.9680
0.984/0 09844009444 9-43
(ave)
0.9754
(ave)
0.998/0.9774
0.998X09754
1..918)
B.8 Analysis of Computational Overhead
We conducted a timing comparison for all watermark methods. Experiments were run on a system equipped with an AMD EPYC 7662 Processor and an NVIDIA RTX A6000 GPU. All inversion- basedd methods utilized FP16 precision and performed 10 inversion steps on an SD v2.1 model [3).
Table 16:
Timing comparison of various watermarking methods. Embedding and verification times are measured seconds (s).
Method
Embedding Time (s)
Verification Time (s)
dwtDet [8
0,047
0.030
dwiDetSvd
0.113
0.065
rivaGan 19
1.327
1.087
StableSig
0.000
0.004
TRW[10]
0,001
0,437
GS
2.253
0.473
PRCW 6
0.006
0.821
T2SMark
0.024
0.420

---

B.9 Impact of the Two-Stage Framework
To assess the impact the two-stage framework, we evaluate T2SMark both with and without it. All experiments use Stable Diffusion v2.1 [3] under the same settings as the main paper. For robustness testing, we sample 500 prompts from the Stable-Diffusion Prommosss training split; for generation diversity, we use 1,000 prompts from the same dataset and report LPIPS scores [29]. Results are
shown in Table 17
Enabling the two-stage framework reduces adversarial bit accuracy from 0.9868 to 0.9754, since reserving latent dimensions to encrypt the session key cuts redundancy and causes cascading er- rors-any mistake in decoding the session key invalidates the second-stage decoding. However, it substantially increases generation diversity, confirming its importance for balancing robustness and diversity. In contrast, without two-stage encryption, T2SMark suffers from the same fixed-codeword limitation as Gaussian Shading [5] and overconcentrates energy in the high-energy tail region, whose position in the latent vector is entirely key-dependent, significantly reducing diversity.
Table 17: Performance of T2SMark both with and without the two-stage framework.
Bit Ace. (Clcan/Adv.)
Diversity t
w/o two-stage w/ two-stage
1.0000/0.9868 1.0000/0.9754
0,5689
0.6746
C Visual Results
10, and visually compare the generation diversity achieved by various watermarking methods on SD v2.1 and SD v3.5M. Images produced with Gaussian Shading
Generation Diversity. Figure 8
5) for example, display highly consistent layout, indicating limited diversity.
18

---

TRW
GS
PROW
T2SMark
Figure 8: Diversity images generated by different watermarking methods via SD v2.1 (guidance
scale 7.5, 50 inference steps) on the prompt "A guy is having fun skiing down the slope of the hill."
SD v2.1
TRW
GS
PRCW
T2SMark
Figure 9: Diversity of images generated by different watermarking methods via SD v2.1 (guidance scale 7.5, 50 inference steps) on the prompt "Two giraffes zoo enjoy a walk and a snack." "
19

---

SI v2.1
TRW
GS
PRCW
T2SMark
Figure 10: Diversity of images generated by different watermarking methods via SD v2.1 (guidance scale 7.5, 50 inference steps) on the prompt "A man uses his computer on park bench."
SD v3.5M
TRW
GS
PRCW
T2SMark
Figure 11: Diversity of images generated by different watermarking methods using SD v3.5M (guidance scale = 4.0, 40 inference steps) on the prompt "A guy is having fun sküng down the slope of the hill."
20

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: Section | presents the main contributions of this paper, which are concisely summarized in both the abstract and the introduction.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: The potential attack vectors and usage limitations of our method are discussed in Section
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model sell-speciiiitiinn asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the pelformance the ap- proach. For example, a facial recognition algorithm may pelform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
21

---

Answer: [Yes]
Justification: This paper includes theoretical result, and the assumption and proof are provided in Appendix
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: We include complete experimental details in Section 4.1 and Appendix B. to enable reproduction of our results.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, other means that appropriate to the research performed.
also be provided via detailed
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reprodueibility may be tricky in some cases, in which authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing or verifying the results.
5. Open access to data and code
22

---

reproducible, they Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: Our code is provided the supplementary material, with detailed usage instructions available in the accompanying README.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.c cc/
public/guides/ Soaeleese/CooeSuuubsssiiiiiii
for more details.
While we encourage the release of code and data, we understand that this might be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
/
Coaee//dddeSebmmmcma ssi onPolicy) for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: We provide detailed settings in Section 4.1 and Appendix B.I
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: We report the means and standard errors for experimental results in Tables [ and
12
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
23

---

The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful figures symmetric error bars that would yield results that are out of range (e.g. negative rates).
show in tables or
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
The GPU used to conduct our experiments is specified Section 4.1
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't 't make it into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification:
The research conducted in the paper conforms with the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive socictal impacts and negative societal impacts of the work performed?
Answer: [NA]
Justification: The answer NA means that there is no societal impact of the work performed.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.

---

Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), faireess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper deseribe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
The answer NA means that the paper poses no such risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [NA]
Justification:
The answer NA means that the paper does not use existing assets
Guidelines:
The answer NA means that the paper does use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website). the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms use in package should be provided. For popular datasets, paperswithcone com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
25

---

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
this information is not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
The answer means that the paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethies, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification: The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere the NeurIPS Code of Ethics and the guidelines for their institution.
26

---

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA]
Justification: The NA means that the method development in this research does not involve LLMs as any important, original, or non-standard components.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non non-standard components.
Please refer to LLM policy lhttps://neurip::: http://narrppp.cc/ooeeeeeeeeeeee / for what should or should not be described.
27


Reviews:
[{"review_id": "OyzSGmi4gg", "reviewer": "Reviewer_eVQe", "summary": "Problem: \nA challenge for existing NaW methods, such as Gaussian Shading (GS) and PRC-Watermark (PRCW), lies in obtaining an optimal balance between watermark robustness and generation diversity. Some methods (ex: GS) heavily constrain initial noise sampling and therefore prioritize strong robustness which limits the variability of generated images. Other methods (ex: PRCW) that preserve diversity are sometimes fragile for real-world deployment as they fail under common distortions.\n\nMethod\n- To address the above issue, the paper introduces T2SMark, a novel two-stage watermarking scheme which is based on Tail-Truncated Sampling (TTS). \n- T2SMark's design has two primary innovations:\n   1. TTS enhances robustness by embedding bits exclusively within the reliable tail regions of the Gaussian distribution, while randomly sampling the central zone to maintain the latent distribution. This approach is different from previous methods that just map bits to positive or negative values - using the statistical properties of the noise for improved resilience.\n   2. The two-stage framework ensures sampling diversity by integrating a randomly generated session key into both encryption pipelines - Static master key encrypts this random session key in the first stage, which then encrypts the actual watermark bits in the second stage. This encryption introduces controlled randomness across the full noise vector and preserves generation diversity.   \n\nEvaluation\n- The method is evaluated on diffusion models with both U-Net and DiT backbones which demonstrates its ability to achieve an optimal balance between robustness and diversity. \n- The method shows better traceability and competitive detection performance, while effectively preserving image quality and generalizability across different diffusion model architectures.", "questions": "1. \"T2SMark is highly vulnerable to Gaussian noise, which is a common real world perturbation that challenges its optimal balance for real world deployment\" - Please discuss any strategies to mitigate this.\n2. \"Bit accuracy drops rapidly with longer session keys due to cascading errors, and the 16 bit key's sufficient entropy\" - this claim needs stronger justification for adversarial environments. Provide a more rigorous security analysis of the session key length and explain how imperfect session key recovery impacts traceability and detection.\n3. Visual Results - please provide more example images in Appendix C visual results (preferably images with text in them) to clearly show diversity and that image quality is maintained. It would also be helpful to add SSIM and PSNR metrics for image quality.", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "STRENGTHS:\n1. Principled method:\n    - TTS is introduced to enhance robustness by embedding bits in the more reliable tail regions of the Gaussian distribution - this is supported by theoretical BEP analysis in Appendix A which shows that truncation decreases bit error probability. \n    - The two stage key hierarchy ensures generation diversity and robustness by using a random session key, encrypted by a master key, to then encrypt the watermark bits, injecting randomness across the noise vector. For decoding, multidimensional projections of the reconstructed Gaussian noise are used to recover watermark bits robustly.\n2. Comprehensive experiments\n    - Comparison against multiple baselines - traditional post processing, fine tuning, and SOTA inversion based techniques.\n    - Multiple metrics (TPR, Bit Acc, LPIPS, CLIP score, FID) are used for evaluation, and undetectability is assessed via a ResNet classifier. \n    - Robustness is evaluated on 9 distortion types\n    - Evaluation on both SD 2.1 (UNet) and SD 3.5 M (DiT) demonstrates the method's generalizability across different diffusion model architectures.\n3. The results clearly show T2SMark's balance across robustness, diversity, and quality, many times outperforming or matching baselines. \n4. Sufficient implementation details are provided for reproducibility - specific SD versions, guidance scales, denoising steps, PyTorch version, GPU used and relevant Github codes.\n\nWEAKNESSES\n1. T2SMark is highly vulnerable to Gaussian noise, even at low intensities which is a practical concern for real-world deployment and a common limitation for inversion-based methods.\n2. The ablation study shows rapid bit accuracy drop for longer session keys due to cascading errors, raising scalability questions for high-entropy keys.\n3. Empirical tuning of parameters like truncation threshold τ suggests potential sensitivity to new model architectures, requiring re-tuning for optimal performance.", "was_revised": true, "final_justification": "The authors have addressed all my questions. I will maintain my rating.", "rebuttal": "Thank you for your time and valuable feedback on our submission. We have carefully considered each point raised and address them individually below.\n\n---\n\n### **Re: Vulnerability to Gaussian noise and corresponding solutions (Weakness 1 & Question 1)**\n\nWe acknowledge T2SMark's vulnerability to Gaussian noise. While this is a limitation, it is important to note that our method's performance gap compared to baseline methods under Gaussian noise is marginal (only 0.53% lower than GS, shown in Table 10). \n\nWe attribute this sensitivity primarily to the inherent nature of diffusion models (considering their training process), and our two-stage watermarking framework's cascading errors could amplify this effect. Given the diversity gains from our two-stage approach, we consider this a justifiable trade-off.\n\nAs for mitigation, any general method for improving robustness (e.g., adding error-correcting codes) can alleviate this. To specifically address the issue of additive noise like Gaussian and Salt-and-Pepper, we found that such noise is readily distinguishable by a simple model. Furthermore, applying traditional filtering methods *before* inversion proves highly effective at removing this noise.\n\nTo demonstrate this, we trained a four-layer convolutional neural network for noise detection. If the target noise is detected, the image is first filtered and then inverted. The results are as follows:\n\n|  | Clean (TPR/Bit Acc) | GauNoise (TPR/Bit Acc) | S&PNoise (TPR/Bit Acc) | Other Noise (TPR/Bit Acc) | Adv ave. (TPR/Bit Acc) |\n| --- | --- | --- | --- | --- | --- |\n| Without Classifier&Filter | 1.000/1.000 | 0.988/0.8982 | 0.998/0.9487 | 0.999/0.9913 | 0.998/0.9762 |\n| With Classifier&Filter | 1.000/1.000 | 0.996/0.9495 | 1.000/0.9971 | 0.999/0.9909 | 0.999/0.9870 |\n\nThese results indicate that this plug-and-play module improves performance under Gaussian and Salt-and-Pepper noise with only a minimal impact on other distortions. In our experiments, the classifier successfully detected the target noise with a 94.9% probability while maintaining a low false positive rate of only 2.6%.\n\n---\n\n### **Re: Scalability of the session key (Weakness 2 & Question 2)**\n\nRegarding the statement \"a 16-bit key provides sufficient entropy,\" our original intent was to refer to its sufficiency for generating diversity. For individual users, ensuring distinct session keys allows for the generation of up to $2^{16}=65,536$ images without repeating a codeword, thereby guaranteeing diversity. While enterprise users might require a larger keyspace, our method still maintains competitive performance with 24-bit and even 32-bit keys.\n\nFor traceability, the session key serves as the crucial seed for a pseudo-random number generator used in the second-stage decryption. Even a minor alteration to this seed will cause the pseudo-random sequence to diverge significantly, rendering the second-stage decoded watermark meaningless. Therefore, perfect recovery of the session key is paramount for successful traceability.\n\nRegarding detection, we designed this functionality to operate in the first stage, which inherently protects it from the impact of cascading errors. As shown in Table 7, detection performance exhibits very minimal variation with changes in session key length.\n\n---\n\n### **Re: More visual results (Question 3)**\n\nCurrent NeurIPS 2025 policy does not allow us to provide additional visual evidence directly within the rebuttal or discussion phase. However, we are fully committed to including more example images, particularly those with embedded text, in Appendix C if the paper is accepted, to clearly showcase both diversity and maintained image quality.\n\nAs compensation and to address your concern regarding diversity, we conducted a user study. We randomly selected 20 prompts for each of 25 participants. For every prompt, we presented a set of five images generated by different watermarking methods and also a non-watermarked baseline. Participants were then asked to choose the set they perceived as most diverse. Our results, presented below, largely align with our quantitative diversity measurements in the paper, which we hope alleviates your concerns:\n\n| Method | SD v2.1 | StableSig | TRW | GS | PRCW | T2SMark |\n| --- | --- | --- | --- | --- | --- | --- |\n| Win Rate | 0.174 | 0.140 | 0.128 | 0.112 | 0.240 | 0.206 |\n\nRegarding SSIM and PSNR, these are *relative* metrics that measure differences from an original image. As a NaW method, T2SMark encodes watermarks directly into the initial noise; thus, there is not a strict \"original image\" counterpart to compare against. Instead, image quality is assessed by evaluating the overall quality of the generated content. In this paper, we generated a total of 10 sets comprising 10,000 images. Similar to GS, we performed t-tests on CLIP and FID scores against unwatermarked images for all methods. A smaller t-value indicates greater indistinguishability from unwatermarked images. The t-test results are provided in Table 1 and Table 3, with further details in Appendix B.3. Appendix B.5 also offers results on additional datasets. We believe this provides sufficient evidence of maintained image quality.\n\n---\n\n### **Re: Empirical tuning of parameters (Weakness 3)**\n\nFor practical deployment, our hyperparameters offer a broad selection range. Our experiments  show the truncation threshold (τ) performs poorly only at extreme values (too large, reducing redundancy; too small, leading to bit flips and degrading to normal sampling). It maintains similar performance across most of its range (Table 8), and we did not pick the absolute optimal threshold. Similarly, the chosen session key channel has limited impact (Table 9). \n\nOur generalization experiments (Section 4.4) further support this: we achieved SOTA performance (Table 3) on new architectures without any empirical hyperparameter re-tuning. More detailed experimental settings about it can be found in Appendix B.1."}, {"review_id": "LeHZ4kDN92", "reviewer": "Reviewer_bX8p", "summary": "The paper proposes T2SMark , a watermarking framework for diffusion models that balances robustness against distortions and enhances generation diversity. It introduces a two-stage approach with a tailored inversion process to embed watermarks and a tail-truncated sampling (TTS) strategy to enhance robustness.", "questions": "1. Following the weakness 1. Besides the TTS sampling, is there any other contributions make T2SMark significantly outperform the GS baseline? \n2. Following the weakness 2. Can the authors provide a theoretical analysis of TTS sampling and why it makes watermarking more robust and diverse? How is the threshold $\\tau$ calculated, or is it determined empirically?\n3. Following the weakness 3. Despite the TTS mechanism, why does T2SMark remain vulnerable to Gaussian noise? Could this be mitigated via robust optimization during inversion?\n4. The diversity is measured by the LPIPS metrics. While LPIPS is commonly used for image perceptual quality. I have a concern about this metric for its effectiveness in representing diversity. Can the authors provide more evidence to support the appropriate usage of LPIPS for diversity? To further estimate the diversity, I believe authors should show more visualizations and even user study to support their claim.\n5. The GS baseline can keep the watermarked results similar to the original non-watermarked generated results, and it is also able to show diversity to some extent. Can the T2SMark method also preserve the similarity between the watermarked results and non-watermarked model results? So that users can flexibly watermark their generated results.\n6. Can the proposed method be extended to the Diffusion Transformer method?", "limitations": "yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths\n\n1. T2SMark introduces TTS, which partitions the Gaussian noise distribution into three regions bit-0, bit-1, and an undecided central zone. By embedding information exclusively in the reliable tail regions and randomly sampling the central area, the method reduces sign errors caused by noise perturbations while preserving the latent distribution.\n\n2. The two-stage framework with hierarchical encryption structure to randomize bit messages, ensuring diversity in generated outputs without compromising security. \n\nWeakness\n\n1. Similar to Gaussian Shading (GS). T2SMark proposes a similar watermarking paradigm to the GS method. They all use a master key to generate a session key and then encrypt it into the noise vector. The watermark decoding all relies on the DDIM. There is a lack of comparison with the GS baseline to highlight the contribution of the T2SMark from the methodology perspective. \n\n2. Limited theoretical insights. The paper focuses on empirical validation with minimal theoretical analysis of the TTS mechanism or robustness guarantees. The TTS sampling also relies on the pre-defined threshold $\\tau$, which can be case-by-case sensitive.\n\n3. Vulnerability to Gaussian noise: The inversion process remains sensitive to this distortion, a known issue in prior inversion-based methods. The authors acknowledge but do not resolve this.", "was_revised": true, "final_justification": "See the comments.", "rebuttal": "Thank you for your constructive feedback and detailed evaluation. We have addressed each of the points raised in our responses below.\n\n---\n\n### **Re: Contributions besides the TTS sampling (Question 1 & Weakness 1)**\n\nT2SMark's improvements go beyond TTS sampling. T2SMark enhances watermark randomness through its two-stage framework. We also would like to make it clearer: our session key is not generated from the master key; instead, it is independently randomized in every generation. This leads to better generation diversity compared to GS (quantitative data is in Table 1; furthermore, in Figure 8, GS-generated images consistently show a black shadow in the bottom-left region, a problem not seen with other methods). In terms of security, T2SMark is also notably harder to detect than GS (Table 2).\n\n---\n\n### **Re: Theoretical analysis of TTS sampling (Question 2 & Weakness 2)**\n\nDue to main paper page limitations, our detailed theoretical analysis of TTS is provided in Appendix A, explaining why TTS leads to stronger robustness. \n\nRegarding diversity, while the random region in TTS does offer some compensatory effects, the primary contribution comes from our two-stage framework. This is because the codewords reside in the tail regions, where they possess higher energy. For instance, a 16-bit session key can still provide 65,536 random variations for the codeword, even when the master key and watermark remain fixed. An ablation study on the two-stage framework, demonstrating its considerable improvement in diversity, is included in our supplementary materials.\n\nConcerning the threshold determination, we set it empirically rather than by calculation (Appendix B.2). This approach is taken because real-world noise environments can be complex and may not perfectly align with theoretical assumptions. Specifically, we iterated through various Gaussian distribution quantiles and chose a value that demonstrates favorable performance. Moreover, the truncation threshold (τ) performs poorly only at extreme values and maintains similar performance across most of its range, demonstrating robustness. Our generalization experiments (Section 4.4) further support this: we achieved SOTA performance (Table 3) on new architectures without any empirical hyperparameter re-tuning. \n\n---\n\n### **Re: Vulnerability to Gaussian Noise (Question 3 & Weakness 3)**\n\nTTS is a general enhancement that improves watermark performance across all distortions. Gaussian noise impacts our method more significantly due to our two-stage framework, where the session key in the first stage must be perfectly recovered; even a single bit error can lead to decoding failure.\n\nWe believe this sensitivity to Gaussian noise is an inherent characteristic of diffusion models (considering their training methodology). The suggestion of robust optimization during the inversion process is a valuable direction for future work. However, such optimization might involve substantial computational complexity, and we currently lack concrete ideas for its implementation. A naive approach involves fine-tuning the model in an adversarial environment, though this would obviously compromise generation quality.\n\nAlternatively, we found that independent additive noise, including Gaussian noise, is readily distinguishable by a model, and applying traditional filtering methods before inversion is quite effective at removing it. To illustrate this, we trained a four-layer CNN for an experiment, yielding the following results:\n\n|  | Clean (TPR/Bit Acc) | GauNoise (TPR/Bit Acc) | S&PNoise (TPR/Bit Acc) | Other Noise (TPR/Bit Acc) | Adv ave. (TPR/Bit Acc) |\n| --- | --- | --- | --- | --- | --- |\n| Without Classifier&Filter | 1.000/1.000 | 0.988/0.8982 | 0.998/0.9487 | 0.999/0.9913 | 0.998/0.9762 |\n| With Classifier&Filter | 1.000/1.000 | 0.996/0.9495 | 1.000/0.9971 | 0.999/0.9909 | 0.999/0.9870 |\n\nThese results show that this plug-and-play module improves performance under Gaussian and Salt-and-Pepper noise while having only a marginal effect on other distortions. In our experiment, the classifier successfully detected the target noise with a 94.9% probability, with a false positive rate of only 2.6%.\n\n---\n\n### **Re: Further estimation of the diversity (Question 4)**\n\nIn the context of measuring diversity, we employ LPIPS in a non-standard manner. While LPIPS usually measures the direct visual distance between two images (where a smaller value means more similarity and often better visual quality), we calculate it differently for diversity. For $P$ prompts, and for each prompt generating $N$ images, we compute the visual distance for all $C_N^2$ possible pairs. We then average these distances for each prompt and finally average across all $P$ prompts, formally:\n\n$D = \\frac{1}{P}\\sum_{i=1}^{P} \\frac{1}{C_N^2} \\sum_{j,k,1\\leq j<k \\leq N} d(X_{i,j}, X_{i,k})$\n\nIf the average distance between multiple images generated for the same prompt is small, we consider them similar and thus lacking diversity. Conversely, a larger average distance indicates better diversity. The function $d(·)$ can also be replaced by other distance metrics like CLIP-Image similarity, where a larger value indicates more similarity; therefore, a smaller value would indicate better diversity. Specific results are in the table below.\n\nWe also followed your suggestion and conducted a user study. We randomly selected 20 prompts for each of 25 participants. For every prompt, we provided a set of five images generated by different watermarking methods and a non-watermarked baseline. Participants were asked to choose the set they perceived as most diverse. Our results, consistent with the quantitative diversity measurements in the paper, are shown below, and we hope this addresses your concerns.\n\nOur conclusions on diversity align with previous work. PRC, as a cryptographically undetectable watermark, exhibits diversity nearly comparable to unwatermarked images, while GS shows the lowest diversity due to its fixed key. Our undetectability experiments (Section 4.3) further support this, as the classifier easily distinguishes between GS and unwatermarked images by learning common features.\n\n|  | Diversity-LPIPS-SDP ↑ | Diversity-LPIPS-COCO ↑ | Diversity-CLIPI-SDP ↓ | Diversity-CLIPI-COCO ↓ | User-Study-WR ↑ |\n| --- | --- | --- | --- | --- | --- |\n| SD v2.1 | 0.6756 | 0.7072 | 0.7085 | 0.6949 | 0.174 |\n| StableSig | 0.6667 | 0.6917 | **0.7034** | 0.7051 | 0.140 |\n| TRW | 0.6655 | 0.6943 | 0.7152 | 0.6939 | 0.128 |\n| GS | 0.6156 | 0.6446 | 0.7364 | 0.7123 | 0.112 |\n| PRCW | **0.6747** | **0.7074** | ***0.7095*** | **0.6913** | **0.240** |\n| T2SMark | ***0.6746*** | ***0.7069*** | 0.7112 | ***0.6939*** | ***0.206*** |\n\n---\n\n### **Re: Can T2SMark preserve similarity to non-watermarked results? (Question 5)**\n\nYes, T2SMark successfully preserves the similarity between watermarked and non-watermarked generated results. We performed t-tests on CLIP and FID scores, just like GS did, and our results indicate a very small difference between our watermarked images and their unwatermarked counterparts.\n\nIn contrast, GS's diversity is actually quite limited. Our visual results in Appendix C show that GS-generated images consistently have similar layouts, often with a black shadow in the bottom-left area, a problem absent in our method. Additionally, the results in table above further confirm GS's relatively poor diversity. This lack of diversity can significantly affect user experience, especially when users generate multiple images from the same prompt and expect varied outputs to choose from. If the images share similar layouts, it considerably diminishes their selection options and overall satisfaction.\n\n---\n\n### **Re: Can the proposed method be extended to the Diffusion Transformer method? (Question 6)**\n\nYes! We have shown our method's compatibility with the Diffusion Transformer architecture in our generalization experiments (Section 4.4). There, we compared our approach with other inversion-based methods on SD 3.5M, which is based on the Diffusion Transformer. Our results demonstrate that our method still achieves state-of-the-art performance on this architecture."}, {"review_id": "ItX4LGhs2F", "reviewer": "Reviewer_qjHw", "summary": "The paper addresses the challenge of balancing robustness and generation diversity in noise-as-watermark (NaW) methods for diffusion models. Existing NaW approaches often encode watermarks in sensitive regions of the Gaussian noise space, which compromises either the watermark robustness or the diversity of generated images. To address this, the authors propose T2SMark, a two-stage encoding framework that introduces (1) Tail-Truncated Sampling (TTS) restricts watermark embedding to the more stable tails of the Gaussian distribution, and (2) a Two-Stage secure encoding scheme using random session keys.", "questions": "-\tLPIPS may not be ideal for measuring diversity. While LPIPS reflects perceptual difference, it may not fully capture diversity. Other metrics like Inception Score and CLIP Score may offer complementary insights.", "limitations": "yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths:\n\n-\tCompatible with existing diffusion models. Similar to other NaW approaches, T2SMark does not require any architectural modifications or fine-tuning, making it practical and plug-and-play.\n-\tTail-Truncated Sampling (TTS) is insightful and effective for the balance of robustness and diversity.\n\nWeaknesses:\n\n-\tThe undecided zone may affect the length of the injectable watermark and limit the watermarking capacity.\n-\tEvaluation lacks direct fidelity metrics. Using FID between two unpaired sets is indirect. Pairwise metrics like PSNR between clean and watermarked images would more accurately quantify distortion. \n-\tFigure 1 lacks quantitative support. The current illustration is too abstract. Including numerical comparisons would make the visual argument more credible.", "was_revised": true, "final_justification": "The author's rebuttal has addressed my concerns. However, since it is not closely related to my research topic, my confidence is 3.  Thanks to ACs, Reviewers, and Authors.", "rebuttal": "Thank you for your helpful feedback. We provide our responses to each point below.\n\n---\n\n### **Re: Reduction of the capacity (Weakness 1)**\n\nOur method’s moderation of theoretical capacity is a deliberate design choice, trading a largely academic ceiling, which no current method can practically approach, for substantial gains in real-world robustness. For example, when SD v2.1 generates images at a resolution of 512x512 pixels, the theoretical capacity limit for other NaW methods is determined by the latent space size, specifically 4×64×64 = 16,384 bits. Under our default settings, TTS reduces this upper limit to 8,192 bits by excluding those easy-flipping points. However, no existing method can maintain acceptable performance at such large capacities. In practical scenarios, methods typically operate at significantly lower capacities to ensure robustness. When compared at equivalent and practical capacities, our method consistently demonstrates superior robustness.\n\n---\n\n### **Re: Evaluation lacks direct fidelity metrics (Weakness 2)**\n\nWe would like to clarify that our FID is computed between 1,000 generated images and 1,000 corresponding real images, ensuring semantic alignment.\n\nPSNR is a relative metric that measures deviation from an original image. As a NaW method, we directly encode the watermark into the initial noise, meaning there is no strict \"original image\" for direct comparison. Instead, we assess image quality by evaluating the overall quality of the generated content. In this paper, we generated a total of 10,000 images, organized into 10 groups. Similar to GS, we performed t-tests on CLIP and FID scores against unwatermarked images for all methods. A smaller t-value indicates greater indistinguishability from unwatermarked images. The t-test results are provided in Table 1 and Table 3, with further details in Appendix B.3. We also offer results on additional datasets in Appendix B.5, which we believe is sufficiently convincing.\n\n---\n\n### **Re: Figure 1 lacks quantitative support (Weakness 3)**\n\nThank you for pointing it out! Our original intention was to visually convey how our method achieves a superior balance compared to two SOTA approaches, but the absence of specific quantitative data can indeed be misleading. We have modified the figure following your suggestion. Unfortunately, due to conference regulations, we cannot provide it immediately. We commit to updating this illustration in the camera-ready version if our paper is accepted.\n\n---\n\n### **Re: Further estimation of the diversity (Question 1)**\n\nIn the context of measuring diversity, we employ LPIPS in a non-standard manner. While LPIPS usually measures the direct visual distance between two images (where a smaller value means more similarity and often better visual quality), we calculate it differently for diversity. For $P$ prompts, and for each prompt generating $N$ images, we compute the visual distance for all $C_N^2$ possible pairs. We then average these distances for each prompt and finally average across all $P$ prompts, formally:\n\n$D = \\frac{1}{P}\\sum_{i=1}^{P} \\frac{1}{C_N^2} \\sum_{j,k,1\\leq j<k \\leq N} d(X_{i,j}, X_{i,k})$\n\nIf the average distance between multiple images generated for the same prompt is small, we consider them similar and thus lacking diversity. Conversely, a larger average distance indicates better diversity. The function d can also be replaced by other distance metrics like CLIP-Image similarity, where a larger value indicates more similarity; therefore, a smaller value would indicate better diversity. Specific results are in the table below.\n\nWe also conducted a user study. We randomly selected 20 prompts for each of 25 participants. For every prompt, we provided a set of five images generated by different watermarking methods and a non-watermarked baseline. Participants were asked to choose the set they perceived as most diverse. Our results, consistent with the quantitative diversity measurements in the paper, are shown below, and we hope this addresses your concerns.\n\nOur conclusions on diversity align with previous work. PRC, as a cryptographically undetectable watermark, exhibits diversity nearly comparable to unwatermarked images, while GS shows the lowest diversity due to its fixed key. Our undetectability experiments (Section 4.3) further support this, as the classifier easily distinguishes between GS and unwatermarked images by learning common features.\n\nInception Score calculates class diversity within an image set, making it more suitable for unconstrained generation. Since we use fixed prompts for each method, Inception Score appears unable to reflect the specific diversity in our context.\n\n|  | Diversity-LPIPS-SDP ↑ | Diversity-LPIPS-COCO ↑ | Diversity-CLIPI-SDP ↓ | Diversity-CLIPI-COCO ↓ | User-Study-WR ↑ |\n| --- | --- | --- | --- | --- | --- |\n| SD v2.1 | 0.6756 | 0.7072 | 0.7085 | 0.6949 | 0.174 |\n| StableSig | 0.6667 | 0.6917 | **0.7034** | 0.7051 | 0.140 |\n| TRW | 0.6655 | 0.6943 | 0.7152 | 0.6939 | 0.128 |\n| GS | 0.6156 | 0.6446 | 0.7364 | 0.7123 | 0.112 |\n| PRCW | **0.6747** | **0.7074** | ***0.7095*** | **0.6913** | **0.240** |\n| T2SMark | ***0.6746*** | ***0.7069*** | 0.7112 | ***0.6939*** | ***0.206*** |"}, {"review_id": "kAi90lTAAe", "reviewer": "Reviewer_jfmo", "summary": "This paper proposes T2SMark, a novel two-stage watermarking framework for diffusion models that balances robustness and generation diversity. The method embeds watermark bits exclusively in reliable tail regions of Gaussian noise while randomly sampling the central zone to achieve robustness and diversity. A two-stage key hierarchy (master key + session key) injecting controlled randomness to further preserve diversity. Extensive experiments demonstrate superior watermark traceability, diversity, and minimal visual quality degradation.", "questions": "1. Fundamentally, this work is an extension of the tree-ring watermarking approach, which also modifies the initial noise. Similar methods (tree-ring, Gaussian shading, and PRC) inherently produce images that differ from the original, unwatermarked generations, leading to potentially uncontrolled diversity variations. Newer methods, such as ROBIN [1] and ZoDiac [2], enable watermark embedding during the generation process itself, achieving outputs that are visually indistinguishable from their watermark-free counterparts. The paper, however, appears to overlook direct comparisons with these relevant recent techniques.\n\n[1] ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimization. 2024 NeurIPS.\n\n[2] Attack-Resilient Image Watermarking Using Stable Diffusion. 2024 NeurIPS.\n\n2. Undetectability evaluation assumes fixed watermark and key: This is an unrealistic assumption in real-world settings, where keys vary per user. The classifier’s performance might change substantially in such settings, especially since randomness is a core contribution of T2SMark. Further evaluation with randomized watermark instances would strengthen the claim of imperceptibility.\n\n3. Error propagation can be observed in two-stage decoding under strong noise (Tab.11 GauNoise). Robustness could be improved via error-correcting codes?", "limitations": "yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "### Strengths：\n1.The conflict between robustness and diversity in watermarking diffusion outputs is well-articulated and timely, given the increasing deployment of diffusion models. \n\n2.The two-stage key hierarchy decouples randomness control from watermark encoding, ensuring diversity without sacrificing security.\n\n3.The paper is well-structured and technically accessible.  \n\n\n### Weaknesses：\n1. The watermarking pipeline by modifying the initial noise in diffusion models is relatively common. However, such modification can be substantial and may potentially affect the model's applicability in controllable generation methods that rely on initial noise characteristics, such as Golden noise [1] and InitNO [2].\n\n[1] Golden Noise for Diffusion Models: A Learning Framework. 2411.09502 arXiv. \n\n[2] InitNO: Boosting Text-to-Image Diffusion Models via Initial Noise Optimization. 2024 CVPR. \n\n2. While the paper emphasizes improvements in diversity and provides quantitative results (e.g., LPIPS), the visual evidence is limited. Only one example visualization (Fig. 8 in the Appendix) under a single prompt is provided. Comparisons with more baseline methods through visual results are notably lacking.\n\n3. The paper lacks a comparison of the time overhead, specifically in terms of watermark embedding and verification times, with other existing schemes.\n\n4. The decision to embed the session key in channel 0 (based on inversion error and detectability) appears empirically driven, but the rationale may not generalize across models or sampling resolutions.\n\n5. While multiple attack scenarios are tested, inclusion of rotation would strengthen claims given its prevalence in image manipulations.", "was_revised": true, "final_justification": "See Official Comment.", "rebuttal": "Thank you for your insightful comments on our work. Our responses to each of the points you raised are detailed below.\n\n---\n\n### **Re: Impact on applicability of controllable generation methods (Weakness 1)**\n\nThank you for pointing it out! We will add a discussion on this to Section 5. However, not all controllable generation methods are affected. Our NaW method does not modify already sampled initial noise; instead, it replaces the original initial noise sampling logic with a pseudo-random one. The sampled noise still adheres to the original distribution and is indistinguishable from standard noise without the correct key.\n\nTo clarify, the following discussion is structured by the type of controllable generation method:\n\n1. **Methods that modify the initial noise sampling logic (e.g., require specific noise patterns):** Our watermarking method would conflict with these, as we already replace the default sampling.\n2. **Methods that require only minor modifications to the initial noise:** Our method remains applicable. For instance, with Golden Noise, its perturbation to the initial noise is minimal, far less than typical image distortions or inversion errors.\n3. **Methods that irreversibly alter the denoising process:** Our method is incompatible here. InitNO, for example, performs gradient-based optimization at various denoising timesteps, which compromises the determinism of ODE-based sampling. This is why it cannot adapt to our method, as mentioned in Section 5. If an inversion method corresponding to InitNO's denoising process could be found, we believe our approach would still be applicable.\n\n---\n\n### **Re: Visual evidence is limited (Weakness 2)**\n\nCurrent NeurIPS 2025 policy does not allow us to provide additional visual evidence directly within the rebuttal or discussion phase. However, we are fully committed to including more example images in Appendix C if the paper is accepted, to clearly showcase both diversity and maintained image quality.\n\nAs compensation and to address your concern regarding diversity, we conducted a **user study**. We randomly selected 20 prompts for each of 25 participants. For every prompt, we presented a set of five images generated by different watermarking methods and also a non-watermarked baseline. Participants were then asked to choose the set they perceived as most diverse. Our results, presented below, largely align with our quantitative diversity measurements in the paper, which we hope alleviates your concerns:\n\n| Method | SD v2.1 | StableSig | TRW | GS | PRCW | T2SMark |\n| --- | --- | --- | --- | --- | --- | --- |\n| Win Rate | 0.174 | 0.140 | 0.128 | 0.112 | 0.240 | 0.206 |\n\n---\n\n### **Re: Lack of comparison of the time (Weakness 3)**\n\nWe conducted a timing comparison for all inversion-based methods. Experiments were run on a system equipped with an AMD EPYC 7662 Processor and an NVIDIA RTX A6000 GPU. All inversion-based methods utilized FP16 precision and performed 10 inversion steps on an SD v2.1 model.\n\n|  | Embedding Time(s) | Verification Time(s) |\n| --- | --- | --- |\n| dwtDct | 0.047  | ***0.030*** |\n| dwtDctSvd | 0.113 | 0.065 |\n| rivaGan | 1.327 | 1.087 |\n| StableSig | **0.000** | **0.004** |\n| TRW | ***0.001*** | 0.437 |\n| GS | 2.253 | 0.473 |\n| PRCW | 0.006 | 0.821 |\n| T2SMark | 0.024 | 0.420 |\n\n---\n\n### **Re: The Empirical decision of the channel embedding channel of session key (Weakness 4)**\n\nThe choice of channel is quite flexible, and Table 9 shows that performance differences are minimal. In our generalization experiments with SD v3.5M (Section 4.4), we did not specifically select channels, and its latent space has 16 channels, which is different from SD v2.1's 4 channels. For simplicity, we chose the first four channels to embed the session key and still achieved considerable results (see Table 3). More detailed experimental settings can be found in Appendix B.1.\n\n---\n\n### **Re: Rotation (Weakness 5)**\n\nIn fact, rotation presents a notable challenge for NaW methods like GS, PRCW, and T2SMark since their designs lack explicit mechanisms to resist it, highlighting a key area for research. We will clearly point out this limitation in the paper. \n\nThe recent ICML 2025 paper, GaussMarker [1], offers a promising solution. They developed a novel dual-domain watermark, embedding NaW in the spatial domain and TRW in the frequency domain. They also train a network to recover rotated images for the spatial watermark. Since they successfully used GS as their spatial watermark, we are confident that integrating our method in place of their spatial domain watermark would similarly achieve strong resistance against rotation.\n\n[1] GaussMarker: Robust Dual-Domain Watermark for Diffusion Models, ICML 2025.\n\n---\n\n### **Re: Comparisons with ROBIN and ZoDiac (Question 1)**\n\nWe acknowledge the impressive fidelity to original images and competitive robustness of methods like ROBIN and ZoDiac. Thank you for these helpful references and we will include a discussion of them in the related work section.\n\nHowever, these are 0-bit watermarking schemes, designed solely for detection, and they require gradient-based optimization. In contrast, by not needing to be strictly identical to the original image, training-free NaW methods can fully leverage the initial noise space to achieve a 256-bit capacity for traceability. Given these significant differences in design philosophy, a direct comparison would be unintuitive.\n\n---\n\n### **Re: Assumptions of the undetectability evaluation (Question 2)**\n\nWe believe there might be a misunderstanding regarding our key assumptions. Our method employs two types of keys: a **master key** and a **session key**. The session key varies with every generation, while the master key remains fixed. We contend that the master key should not vary per user. In our threat model (Section 3.1), to trace the origin of an image, we extract the watermark content, which depends on the master key for decoding. If the master key varied per user, we would paradoxically need to know who generated the image *before* decoding the watermark, creating a contradiction.\n\nWe suspect your concern might pertain to the watermark content varying per user, which is indeed the case. However, we consider a more challenging scenario: an attacker seeking to train a classifier would most conveniently obtain sufficient watermarked image samples from a single user's API. In such a scenario, both the master key and watermark content would be fixed, providing the classifier with more consistent information to learn common features. This makes it a more challenging test for watermark undetectability. We will clarify this point clearly in the paper.\n\nRegarding scenarios with randomized watermark instances (varying watermark content), GS, PRC, and T2SMark achieve comparable performance in our experimental setup, all hovering around 50% accuracy. This indicates that this scenario is indeed less challenging.\n\n---\n\n### **Re: Vulnerability to Gaussian noise and corresponding solutions (Question 3)**\n\nThat is a good suggestion! You are right, error-correcting codes could indeed boost our method's robustness. We attempted to incorporate a 1-bit error-correcting Hamming code in the first stage. This increased bit accuracy under Gaussian noise from 0.8982 to 0.9068, while keeping the session key length constant. Multi-bit error-correcting codes like LDPC, might yield better results, but both ECC encoding and our watermarking method require redundancy. Given the limited capacity of the latent space, we found it challenging to balance the allocation of this redundancy between the two.\n\nWe observed that removing Gaussian noise in the pixel domain *before* inversion appears to be a simpler and more effective strategy than applying error correction *after* inversion. Specifically, we found that independent additive noise, including Gaussian noise, is surprisingly easy for a model to distinguish. Plus, removing this noise using traditional filtering methods before inversion is highly effective. To illustrate this, we trained a simple four-layer CNN for an experiment. Here are the results:\n\n|  | Clean (TPR/Bit Acc) | GauNoise (TPR/Bit Acc) | S&P (TPR/Bit Acc) | Other Noise (TPR/Bit Acc) | Adv ave. (TPR/Bit Acc) |\n| --- | --- | --- | --- | --- | --- |\n| Without Classifier&Filter | 1.000/1.000 | 0.988/0.8982 | 0.998/0.9487 | 0.999/0.9913 | 0.998/0.9762 |\n| With Classifier&Filter | 1.000/1.000 | 0.996/0.9495 | 1.000/0.9971 | 0.999/0.9909 | 0.999/0.9870 |\n\nThese results show that this plug-and-play module improves performance under Gaussian and Salt-and-Pepper noise, with only a marginal effect on other distortions. In fact, our classifier successfully detected the target noise with a 94.9% probability, while maintaining a low false positive rate of only 2.6%."}]

Author rebuttal:

Meta-review: The paper proposes T2SMark, a watermarking framework for diffusion models that achieves a balance between robustness to distortions and generation diversity. The method employs a two-stage approach: a tailored inversion process for watermark embedding and a tail-truncated sampling (TTS) strategy to improve robustness.

All reviewers were actively engaged in the rebuttal and agreed that this work represents a solid contribution. Most of the concerns raised during the review process have been satisfactorily addressed. The authors are encouraged to incorporate the reviewers’ suggestions and feedback, as summarized in the final remarks, into the camera-ready version.
Decision: Accept (poster)