BitMark: Watermarking Bitwise Autoregressive Image Generative Models
Authors: Louis Kerner
Michel Meintz
Bihe Zhao
Franziska Boenisch
Adam Dziedzic
Venue: NeurIPS 2025 poster ()
Keywords: Watermarking
Image Autoregressive Model
Generated Content Detection
Primary area: applications
TL;DR: We introduce a bitwise, radioactive watermark for bitwise image generative models and show that it remains robust against various attacks while preserving high image quality and generation speed.

Abstract: State-of-the-art text-to-image models generate photorealistic images at an unprecedented speed. This work focuses on models that operate in a bitwise autoregressive manner over a discrete set of tokens that is practically infinite in size. However, their impressive generative power comes with a growing risk: as their outputs increasingly populate the Internet, they are likely to be scraped and reused as training data—potentially by the very same models. This phenomenon has been shown to lead to model collapse, where repeated training on generated content, especially from the models’ own previous versions, causes a gradual degradation in performance. A promising mitigation strategy is watermarking, which embeds human-imperceptible yet detectable signals into generated images—enabling the identification of generated content. In this work, we introduce BitMark, a robust bitwise watermarking framework. Our method embeds a watermark directly at the bit level of the token stream during the image generation process. Our bitwise watermark subtly influences the bits to preserve visual fidelity and generation speed while remaining robust against a spectrum of removal techniques. Furthermore, it exhibits high radioactivity, i.e., when watermarked generated images are used to train another image generative model, this second model’s outputs will also carry the watermark. The radioactive traces remain detectable even when only fine-tuning diffusion or image autoregressive models on images watermarked with our BitMark. Overall, our approach provides a principled step toward preventing model collapse in image generative models by enabling reliable detection of generated outputs. The code is available at https://github.com/sprintml/BitMark.

BitMark: Watermarking Bitwise Autoregressive Image Generative Models
Louis Kerner, Michel Meintz, Bihe Zhao, Franziska Boenisch, Adam Dziedzic (louis. kerner, mi nichel.og meintz, bihe. zhao, boenisch, adam. (zziedzic)@cispp CISPA Helmholtz Center for Information Security
Abstract
State-of-the-art text-to-image models generate photorealistic images an unprece- dented speed. This work focuses on models that operate in bitwise autoregressive manner over a discrete set of tokens that is practically infinite in size. However, their impressive generative power comes with a growing risk: as their outputs increasingly populate the Internet, they are likely be scraped and reused as training data titta-potettilllyy by the very same models. This phenomenon has been shown to lead model collapse, where repeated training on generated content, especially from the models' own previous versions, causes gradual degradation in performance. A promising mitigation strategy is watermarking, which embeds eeprrepippeee yet detectable signals into generated emages-enabling the identification generated content. In this work, we introduce BitMark, a robust bitwise watermarking framework. Our method embeds a watermark directly at the level of the token stream during the image generation process. Our bitwise watermark subtly influences the bits to preserve visual fidelity and generation speed while remaining robust against a spectrum removal techniques. Furthermore, it exhibits high radioactivity, i.e., when watermarked generated images used train another image generative model, this second model's outputs will also carry the watermark. The radioactive traces remain detectable diffusion or image autoregressive models on images watermarked with our BitMark. Overall, our approach provides a principled step toward preventing model collapse in image generative models by enabling reliable detection of generated outputs. The code available at httttts://gttaaii con/sprintmllBitaaaa
when only fine-tuning
Introduction
The image generation capabilities of large scale models 88 |1 37 12
23 26 have improved
tremendously, These models can now generate at an unprecedented speed high-quality photorealistic outputs, which are often indistinguishable from real images M 37). Several models [1] 37 now achieve state-of-ther fitthhe-rt art performance by operating in a bitwise autoregressive manner [35] This provides them with near infinite number of possible tokens, yielding high nigh-resolution images. This performance, however, comes at the expense of a training process that is highly time-, cost- and most of all data-intensive (25 29 The required training data often scraped from the Internet [3] 24 32.. This practice carries risks: with the ever- wrer-growing amount of generated data on the internet, the models get increasingly trained generated data rather than natural data. The iterative training of models on their own generated data has been shown to degrade performance [1 33), which is referred model collapse. The process also leads encoding the current models' mistakes, biases, and unfairnesses into its future versions [4)] From the perspective of model owners, especially big companies such OpenAI, Google, or ByteDance, who invest large scale proprietary models that are exposed via public APIs, this poses a significant threat. To prevent the possible degradation of model quality, is crucial for them identify their own generated content.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

A promising way to address the above problems is watermarking 4 embedding human- -inpereipppee yet detectable signals into generated images, a model owner can automatically identify and filter out their model's previously generated content when collecting training data for future versions. To prevent model collapse, watermarks should be radioactive [ that is, they should persist across model lineages, so that models trained on watermarked outputs also reproduce the watermark. This is crucial when third parties fine-tune models on such outputs and use them to generate new content, which may later be scraped and reused by the original model-causing it to (unknowingly) train on data derived from its own outputs. While watermarks have been extensively studied in diffusion models (DMs) (9 T0 38 48, watermarking methods have been proposed for image autoregressive models such as Infinity, so far. Additionally, existing DM watermarks have been shown to lack radioactiveness
10 14
22
38
48]
By
28 31
77. motivating the need for new approach.
To close this gap and provide a robust way of detecting images generated by state-of of-thh-art autoregres- sive models operating on bits like Infinity [1I] and Instella [37 we propose the BitMark watermark that aligns with bitwise image generation process and operates directly on a bit-level. We show that this bit-level design is crucial in image autoregressive models, watermarks at the token level-a common practice in autoregressive language models [66 -re suboptimal. This is because unlike language models, which operate on discrete tokens and yield stable token representations, image models must decode to and re-encode from a continuous image space, introducing discrepancies between the original and recovered tokens. These discrepancies can decrease the watermark signal. Yet, we find that the discrepancies are substantially smaller at the bit level (Figure D. motivating our bitwise approach to obtain robust watermark. To embed the watermark, BitMark first divides all possible n-bit sequences into green and red lists, where the green list is supposed to contain sequences indicating the presence of the watermark. The embedding process of the watermark aims at completing one of the green-list bit sequences for every next bit by slightly increasing each logit of the preferred bit that would complete the sequence. This eventually causes the generated image to contain more sequences from the green list than natural images, which can be used for detection. Concretely, the detection of the watermark is performed on re-encoded images and based on the count of bit sequences from the green list.
Our watermark exhibits many desirable properties. Most importantly, the generated images are of similar quality as images generated without the embedded watermark. Moreover, the watermark embedding has a negligible impact the speed of the image generation. Also, the corresponding watermark detection method is fast and reliable. As in natural images all bit sequences are equally likely to occur while watermarked images have the bias towards sequences from the green list, natural images are extremely unlikely to be detected as watermarked. Furthermore, working on the bit-level makes BitMark robust against a wide range of attacks, such as adding Gaussian noise or blur to the image, applying color jitter, random crop, or JPEG compression. Our watermark is also highly resilient against dedicated watermark-remove
techniques. for example, the watermark in the sand attack [42] or CtrlRegen [20]. Finally, we show that BitMark is radioactive. This means that when we use the watermarked images to train or fine-tune other image generative models, our watermark is still present in the outputs from these other models. We demonstrate all these properties through our extensive experimental evaluation.
In summary we make the following contributions:
We propose BitMark- the first watermarking scheme for bitwise image generative models. BitMark leverages the bitwise image generation process of these models to embed the watermark on the level of bits, which preserves the high quality of the models' outputs and its inference speed. We show the success of our method on Infinity and Instella.
We thoroughly evaluate BitMark against wide variety of standard and dedicated watermark removal attacks and show its robustness to all of them. Specifically, BitMark also resilient the watermark in the sand attack [42), which is targeted at removing the watermarks from the generated content. Finally, BitMark is also robust against a Bit-Flipper attack carefully crafted against it.
We also assess BitMark's 's radioactivity and show that when other image-generatien models are trained or fine-tuned on images watermarked with our method, these new models' outputs will also contain our watermark. This makes BitMark highly suitable to identify generated content and contributes to preventing model collapse due to iterative training a model on generated images.
2

---

2 Background
We first introduce image autoregressive models, with a focus on the state-of-the-art text-to-image models that operate bits, namely Infinity and Instellaoperating in an autoregressive manner. We then provide an overview on techniques used to robustly watermark image generative models.
Visual AutoRegressive Modeling ( (VAR) 35
VAR leverages discrete quantization to predict tokens as residual maps, scaling from an initial low scale (coarse-grain) to a final scale (fine-grain) resolution. VAR further leverages the transformer architecture [36] across all tokens significantly improve generation quality. VAR was extended from to--iage to the Infinity model [[I], which is text-to-iman -i-iiage autoregressive model for high-resolution image synthesis, using next- scale prediction similar to VAR [35. Instead of leveraging index-wise tokens for quantization like VAR [35], Infinity uses bitwise token prediction with an implicit codebook and applies binary spherical quantization 47 to select an entry from the codebook. This results in more efficient computation and further enables the usage of large codebook sizes, e.g., 264. Random bit flipping further empowers the model to self-correct on each scale, leveling out errors stemming from earlier tokens. The visual autoregressive paradigm instantiated by Infinity achieves the state-of-the-ar art (SOTA) in image generation. Instella 37 is a token-lightweight next-patch prediction autoregressive model. efficiently leverages bits to minimize the number of tokens required for generating high- resolution images, reducing it to as few as 128 tokens. This bitwise paradigm allows Instella to achieve competitive results in image generation with significantly lower computational resources.
Watermarking Images. Watermarking entails embedding a message, pattern, or information into an image, that can be detected. The embedded information should be hard to remove and can be also used to verify the provenance of the image. In general, the watermarking methods can be either static or learning-based. In static watermark embedding, transform is directly applied an image (22). Learning-based methods are generally based on three key components: a watermark (w), an encoder (E) and a decoder (D). The encoder is trained to embed the watermark into the image, while not impacting its quality and the decoder is trained to reconstruct the watermark given a watermarked image to perform detection. An important aspect of watermarks is the trade-off between their detectability and their impact on the quality of the data, which was thoroughly analyzed in [39].
Watermarking Diffusion Models. Learning- baasd watermarks represent the SOTA for Diffusion 48). They target different points of the image generation process, such as the initial data used train the model 48 noise prediction [10 38) the decoding process 9 The Recipe method (48] embeds a binary signature into training data using a pretrained encoder-decoder and trains an explicit decoder extract this watermark from outputs. In contrast, Tree-Ring (38] embeds a structured pattern in the initial noise vector, designed in the Fourier space, achieving robustness to transformations by enabling detection through inversion of the diffusion process. On the other hand, the PRC Watermarking [10] generates the initial noise vector from a pseudorandom correccong code, allowing deterministic reconstruction of the noise for watermark retrieval. Finally, Stable Signature [9] fine-tunes the latent decoder of latent diffusion models (LDMs) to insert a recoverable watermark using pretrained extractor, modifying the generation process at the decoding stage. However, the watermarking techniques for diffusion models are not radioactive (7, hence, do not prevent the model collapse.
Models [ 10
38
Watermarking Autoregressive Models. As of now, all the efforts on watermarking autoregressive models have been directed towards creating watermarks for Large Language Models (LLMM) (16) The KGW watermark [16] uses the concept of a green and red token lists, where generation is softly nudged to predict tokens from the green list rather than from the red list. The lists are generated dynamically, based on the hash value of the previously predicted token(s). For detection, the LLM used generate the text is not needed. Instead, suspect text is assessed based on how often tokens from the green list appear, compared to tokens from the red list. At the end of detection a statistical test is performed. KGW was extended to the Unigram- Unigram-Waterman Watermark [46), which simplifies the design by introducing a fixed global green and red lists. The simplified approached allowed for guaranteed generation quality, provable correctness in watermark detection, and robustness against both text editing and paraphrasing. In this work, we build on these watermarking schemes originally developed for large language models to address the lack of watermarking techniques for bitwise generative models.
3

---

Private Watermarking, In our watermark, we follow the Private Watermarking from KGW [[]]. For this end, the generative model kept behind secure API with a secret key K. This secret key K. is used as input to pseudorandom function (PRF) F. with the h previously generated tokens, to compute the red-green list split for the next predicted token. Here the context window h is a hyperparameter, which trades robustness with privacy. For small context windows h (e.g., 1 or 2) the watermark is robust against removal attacks but an attacker could tabulate the frequency of token pairs and brute-force knowledge about the green list, reducing the privacy of the method. For larger values of h (e.g., 5), changing a single token has an impact on the next downstream tokens, potentially flipping them to the red set. The privacy of this approach can also be boosted by using k different private keys and choosing one randomly during generation.
Watermark Robustness. To reliably perform image provenance, a watermark must be robust to removal attacks. There wide range of these kinds of attacks that have been proposed in the literature 22 20 27
For example, the scrubbing attacks aim at removing the watermarks from the outputs of a generative model, which can be done by producing a valid paraphrase that is detected as non- watermarrdd text [15] or image (3. Zhang et al. [42 claim that under the assumption that both a quality oracle (that can evaluate whether a candidate output is a high-quality response to prompt) and a perturbation oracle (which can modify an output with a nontrivial probability of maintaining quality) exist, it is feasible to remove existing watermarks in generative models without quality degradation of the watermarked content. We evaluate our BitMark against a wide spectrum of attacks and show that our method is robust against them.
3 BitMark Method
The autoregressive image generative models that we consider, namely Infinity 11 and Instella 37, predict bits instead of tokens, distinguishing them from other image autoregressive models such as VAR (35 or RAR [1]. We leverage this prediction scheme to design a dedicated watermark. Our BirMark watermark is embedded during the generation process, subtly shifting the bitwise representation towards a higher frequency of detectable patterns to resist manipulation.
Problem Formulation and Desiderata. Our goal is to embed watermark during the image generation process and subsequently detect it by analyzing the generated image. BitMark targets the prevention of model collapse. In this setup, only the model owner is concerned of detecting the watermark and wants to ensure that their own data are not used to train their next models. Thus, we aim at four essential properties for our watermarking scheme prevent model collapse: (1) Negligible Impact on the Generation. To maintain the utility of the generative model, the watermark should not degrade the quality of the generated images, while also maintaining fast inference speed. (2) Reliable Verification. The model owner should be able to detect the watermarked images and verify the confidence of the extracted watermark. The model owner encodes the image to their own space and it is only relevant to the model owner if the watermark is present there or not. The encoder part of the model is also kept private so only the model owner can verify the watermark. The natural images should not be detected as containing the watermark. At the scale of the large models trained on trillions of samples, small number of false positives acceptable as long as it does not exceeds a certain threshold (e.g., 1%), which can also prevent model poisoning [45]. (3) Robustness. The watermark should be robust not only against conventional attacks, such as Gaussian noise or JPEG compression, but also against strong dedicated watermark removal attacks such as CtrlRegen 20) or watermarks in the sand [42. (4) Radioactivity. If other generative models are trained on watermarked images, images generated by these new models should also contain our watermarks 7 28 31
Threat Model. We assume two parties: a model owner providing image generation API where our BitMark is deployed, and an attacker who aims to fool the model owner to train on their own generated images and to prevent the use of large-scale natural image datasets for model training. We assume that the model owner follows the Private Watermarking from [16] and keeps the generative model behind a secure API. The model owner wants to watermark their own images in order not to train on them. The watermark should also be radioactive so that if any other party fine-tuner their own models on the watermarked data, the fine-tuned model's outputs are watermarked, as well. Further, we assume that the watermarking technique is private and verifiable by the model owner. On the other hand, the attacker might attempt to remove the embedded watermark. For instance, competitors might still want to remove the watermark to harm the model owner. We assume that the attacker has black-box access to the model, i.e., they can provide inputs and observe the corresponding outputs. The attacker is allowed to make arbitrary modifications to the generated image, including

---

but not limited to: applying image transformations (e.g. noising, blurring, cropping. etc.) specific watermark removal techniques 200 42 We define adversarial behavior as any attempt to remove the watermark in the generated image while preserving high perceptual quality and semantic content. Attacks that destroy the usefulness or visual coherence of the image (e.g, replacing it with noise) are not considered meaningful threats.
3.1 Motivation for the Bitwise Watermark
We identify an inherent challenge in watermarking the images generated by autoregressive models stemming from imperfections in image encoding and decoding. Specifically, the model first generates a sequence of tokens, which are decoded into an image. However, when the exact same image is re-encoded and tokenized, it produces different set of tokens. This also holds partly true for bits that underlie the tokens. The observed behavior does not occur in the autoregressive L.M,s, where the tokens produced by decoding and then re-encoding generated text match exactly. We quantify the bit and token dis- crepancies in Figure for Infinity. In both cases, bits and tokens are generated by the model and then reconstructed by its auto-encoder. Here, the highest bit overlap occurs at the initial and final resolutions (scales). This is likely because the early stages cap- ture coarse structural features, while the final reso- lution refines the image, leading fewer changes in the bit sequence. We observe a consistent aver- age token overlap of approximately 2.385% and bit overlap of 77.43... 77.32%. Given the significantly large codebook size of 232 in Infinity, we observe that the bitwise information loss is much smaller than the token-wise loss. This motivates our work design watermark that biases the generated sequences of tokens on the bit-level instead of on the token-level.
100%
1 Moan Std Dev for bits
90%
80%
Overtap
40%
20%
0%
Scale Index
Figure 1: Bit and token overlaps in Infinity.
3.2 Embedding our BitMark Watermark
Next, we detail how BitMark is embedded. The embedding protocol is directly applied the biv-level in the autoregressive generation process of the model. We present the full procedure for multi-scale models like Infinity in Algorithm [ and for single-scale models like Instella TAR in Algorithm 3 First, we separate the list of all bit sequences of length n: S = (0, 1)" into a red list and a green list G. Intuitively, we softly nudge the model generate bit sequences of length that are part of the green list G. For each next bit prediction bj. if the bit can complete one of the bit sequences from G, we add a small bias 8 to the logit 1(h;) of the bit by:
exp(1 +5)
pre pre bj E G
exp(1) "2) >exxp( +6)
Pj
(1)
exp(1
pre + -b R.
exp(1) H+xxp(1 (3) +5)
where pre = (b) (0 (n)-.,))
.b....,,b1 1) is the prefix bit sequence of length (n 1), i.e., the sequence of bits preceding 6,, + is the bit concatenation operation, and L the vector of logits for the bit by- We apply this procedure to all bits that are generated by the model. Thus, as many bit sequences as possible are biased towards G and the final green fraction, i.e., the number of sequences part of the green set, of the generated bits is significantly above the threshold of 50%, the standard fraction for clean images (see Section (..... By biasing the logit for the preferred bit, BitMark has negligible impact on image quality, as mostly high entropy bits are flipped (see Ta)le Since high entropy bits have sufficiently small difference in the probability of assigning them to value or 1, the relatively small added bias influences the final value. Additionally, biasing only the logits makes the watermarking process difficult to revert, as it difficult to know for an attacker which bits are of high entropy and can be flipped to the red list R without degrading the final image quality (see Figure 9).
5

---

3.3 Watermark Detection
Watermark detection is performed directly on the bits of encoded images. All that is required is knowledge about the green and red lists, well as access to the tokenizer. Intuitively, we count how often each sequence of bits the encoded image follows the green list and compare how the frequency differs from watermarard images.
Detecting the Watermark. The detection protocol follows the standard encoding of the model and and
is detailed for multi-scale models in Algorithm and for single-scale models in Algorithm 4 First we obtain the bit representations for each resolution. We then use our knowledge of G and R to test how often the bit sequences from the red and green lists appear and count them. This results in the knowledge of how many green sequences appear in the encoded image, which is random for every non-watermarked image, i.e, 50% (see Section F.
Robust Statistical Testing. Given the final number of green and red sequences detected in the encoded image, we perform a statistical test based on the null hypothesis Hg The sequence of bits is generated with no knowledge about the green and red lists. Intuitively, this assumes that given image is not watermarked. A watermarked image consists of 7I' green and (1 - >) red bit sequences, where " determines the size of the green list and T is the total number of bits in the encoded image that our watermark can influence. Per a given token t with m bits, BitMark influences k m nn- 1) bits, since we start watermarking from the first n bit pattern. Thus, overall we have T= == k, where r; is number of tokens per resolution i. A natural image is expected to violate the red list rule with the half of its bits, while watermarked image violates this rule less frequently. If the null hypothesis is true, then the number of green list bit sequences denoted C has the expected value of 71' and variance > 7)T To ensure statistical validity, we follow [16] and use a z-test:
== - (TC-TT)/VTT 77)
We reject the null hypothesis and detect the watermark if is above a chosen threshold.
Algorithm 1 Watermark Embedding
Algorithm 2 Watermark Detection
Inputs: autoregressive model fo with parameters 0, green list G, red list R, image decnder D. Hyperparameters: steps K (number of resolutions), resolutions (hu, w;){ the number of tokens for res- olution rr, constant 8 added to the logits of the green list bits, n- the length of the bit sequences in the lists (G' and R), m the number of bits per token.
Inputs:
raw image im, green list G, red list R, image encoder &, quantizer Q
Hyperparameters: steps K (numher of resolutions), resolutions (h,, w;) the number of tokens for res- olution is rr. n the length of the bit vector. c E {(im)
C = 0
for i=ri=1. 1,..., K do
for i ..... K do 0; (Interpolateee, hú; wx)
(I,,... mm)
fo hi, wx)
for 1, ......7y T3 do
M: = (bI, brgm))
for j = n...., m do
C = Count(() (bi,...................... be G)
c (t (t-1) 1) m + /cconntrr
& Lookup u:))
Pc Bias G lz. 6)
2, Interpolate (zi, /x, wK)
8c Softmax (p=)
6 (1(2))
b. (s.)
Return: StatisticalTest(Ho.. (C))
(b....., brg.
Lookup(u.)
2, Interpolate Z4, MK, wx)
e e + (xx)
im = D(e)
Return: watermarked image im
4 Empirical Evaluation
Experimental Setup. In the following, we employ the Infinity-2B checkpoint [1]] as the default model to evaluate BitMark across different watermarking strengths and against a wide variety of attacks. Additionally we show the generalizability of BitMark to other models, namely the Infinity-8B checkpoint as well as the Instella-T21 (37 IAR model. We further show generalizability of our method to bitwise diffusion models in Section
G The Infinity models natively generate 1024 x 1024

---

pixel RGB- GGB-iimaess, we choose the visual-tokenizer with vocabulary size of 2 and 2 per token for the Infinity-2B and the Infinity-&B checkpoint, respectively. We follow Han al. [[]] in the choice of eyper-parameter and use following the scale schedule for an aspect ratio of 1:1. Hence, we utilize the best performing model, tokenizer and hyperparameters reported by Han et al. []]] We ablate the choice of the green and red list split for our p in Section D For Instella IAR we follow Wang et al. [37]. leveraging a vocabulary of size 2 and cfg of 7.5 at a 1024 x 1024 resolution. We evaluate our experiments based on images and prompts of the MS-COCO 2014 [8] validation dataset. Unless stated otherwise,
of 4, with a generation over 13 scales,
we use subset of 10,000 images.
Baselines. To the best our knowledge no prior work developed an in generation time watermarking scheme for autoregressive image models. Therefore we compare the robustness of BitMark against three postprocessing watermarks in Table Namely we analyze RivaGAN 4 (with message length 32), StegaStamp [3 (with message length 100) and TrustMark [5) (with message length 100). We applied the postprocessing watermarks on 1,000 images generated by Infinity-2B.
4.1 BitMark Introduces Detectable Watermarks while Maintaining Generation Performance
We demonstrate that our BitMark preserves the utility of the model with negligible impact on the image quality and the inference speed.
High Image Quality. Table I presents quantitative evaluation of image generation quality for different watermarking strengths dependent on the logit bias parameter 5. We report the FID, KID, measuring the similarity of generated images and natural images in feature space, and the CLIP Score, which measures the alignment between prompt and image, for the varying watermark strengths
The results show that, for 8 < 3. BitMark has a negligible impact on image quality (as mea-
Table 1: Image quality mean (std) vs
sured by FID and KID) and minimally affects
8
FID
KID (x10-3)4 3)
CLIP Scoret
the prompt-following capabilities of the under-
lying model, as indicated by the CLIP Score.
0
33.36
1.42 (0.12)
31.16 (0.28)
We also present a qualitative analysis of image quality in Section
32.61
1.38 (0.13)
31.16 (0.28)
F3 which shows images gen-
2
31.05
1.26 (0.12)
31.15 (0.28)
erated for different d. While there is an inherent trade-off in terms of watermark strength an im- age quality, we choose a small = 2 for the Infinity-2B checkpoint to obtain minimal im- pact on the generation while having a significantly strong watermark. We further show that ō = 1.5 does not negatively impact image quality for Infintiy-8B and Instella in Table
3
29.61
1.03 (0.08)
31.03 (0.27)
4
42.98
1.78 (0.08)
29.78 (0.32)
5
127.44
11.16 (0.34)
26.13 (0.40)
Fast Watermark Generation and Verification. For a watermark to be reasonably applicable in a real
world setting, the watermark should also have negligible impact image generation speed p 38 48)
We thus analyze the practicality of applying BitMark in a standard setting and its impact on generation speed of the Infinity model. Next to the generation performance, the speed of watermark detection has a strong impact on the possible applications, especially in a setting where we want to quickly detect generated data. The quantitative analysis of BitMark in Section shows that generating watermarked image requires at most one-tenth the time longer than the standard image generation. Verification, i.e., encoding image into its bit representation and computing the z-score, takes less than 0.5 seconds per image, usually around 5x faster than the image generation.
4.2 BitMark is Robust Against a Wide Range of Attacks
Our results demonstrate that BitMark is robust against a wide range of attacks, including conventional attacks, reconstruction attacks, watermarks in the sand attack, and our own adaptive bit-slipping attack, with the aim of exploiting knowledge of our watermark method to remove BitMark.
Robustness against Conventional Attacks. We perform a wide range of conventional attacks, namely: 1) Noise: Adds Gaussian noise with std of 0.1 the image, 2) Blur Noise attack + application of a Gaussian blur with a kernel size of 7, 3) Color: Color jitter, a random hue 0.3, saturation scaling of 3.0 and contrast of 3.0, 4) Crop: Random crop to 70%, 5) Rotation: Random rotation between 0' and 180% 6) JPEG: 25% JPEG compression, 7) Horizontal Flipping, 8) Vertical Flipping.
7

---

Table 2: BitMark is robust against watermark removal attacks. We report the @ 1%FPR (%) for the different conventional and reconstruction attacks.
Watermark
Comertional Attacks
Reconsinciin Altacks
None
Notse
Dlur
Color
Rotate
Crop
JPEG
Verical
Horizonial
SD2.1-VAE
CaiRegen+
RiviGAN
99.7
99.4
99.7
StegaStamp
100.0
100.0
100.0
98.7
52.1
1.0
1000
1.0
33.8
100.
44.2
TruiMMrk
1
99.9
99.5
19.9
2.2
2.7
166
99.9
0.7
99.8
99.7
1.1
Gaimny 1.5)
100.0
39.0
19.3
200
95.8
1000
783
To0o
TOO0
91.6
Infiniy--n
100.0
99.7
100.0
75.5
57.6
99.4
99.9
93.8
99.7
100.0
Inseella JAR (6 = 1.5)
100.0
96,0
100.0
75.3
2.7
7.5
100.0
9.3
12.1
100.0
92.6
Table 2 shows that our approach achieves a
Table 3: Rotation attack.
high TPR@ 1 1PFPR for most conventional at- tacks compared to the baselines. Each base-
Degrees
TPR @ 1%FPR
2 (std)
line is weak against at least one conventional attacks. RivaGAN is not robustness against
-20, 20
99.9
14.87 (9.77)
flipping (0%TPR @ 1%FPR), StegaStamp is not robustness against cropping (1%TPR@ 1%FRR) and TrustMark is vulnerable to color jitter (2.2%TPR@)) %FPR), rotation (2.7% (IR@@IFFPP FFPR) and cropping (1.6%TPR @1 FPP)). Although Bit-
-30, 30
87.4
11.78 (9.55)
-40, 40
70.0
9.66 (9.38)
-50, 50
56.8
8.21 (8.99)
Mark for Infinity-2B has slightly lower performance towards arbitrary rotation angles, the watermark still highly detectable and it obtains high TPR @ 1%FPR within a given rotation threshold. We report TPR @ &FPR and mean (std) of z for different degrees of rotations for 1,000 images in Section F2 Notably, it achieves high as 99.9% TPR @ FPP when the rotation range between -20" and 20 as shown in Table 3 Given the strength of off-the-shelf tools for rotation estimation (21]. it is highly achievable to rotate the image back into tolerable range of rotations during the pre-processing stage of the detection, resulting in TPR @ I 1&FP of 98.3% for randomly rotated images as shown in Table 13 Table 12 provides an ablation of the robustness of BitMark given different values of 6, show- ing that BitMark for Infinity-2B is highly robust against most attacks even with 5 = 1. Infinity-88 is more robust against rotation compared to the smaller 2B checkpoint. The effectiveness of BitMark on Instella IAR is by design very limited, given its total number of 128 tokens, corresponding to 4,096 bits, per image.
Robustness against Reconstruction Attacks. We also evaluate our proposed method against two state-of-the-art reconstruction attacks (shown as the last two columns in Table 1) SD2.1-VAE.
Encoding and decoding with the Stable Diffusion 2.1 autoencoder 226, 2) CtrlRegen+: Application of controllable regeneration from noise in the latent space following [20). Regarding reconstruction attacks, our results indicate that BitMark for Infinity-2B is robust against the CtrlRegen+ recon- struction attack, achieving 1..%TTP @ FPP.. Also Instella IAR achieves strong robustness of 93.6%TTPM @1 FPPR In contrast, RívaGAN and TrustMark demonstrate a lack of robustness with TPR @1 &FPR and 1.1 TTRR @ FRR,, respectively. StegaStamp exhibits partial robustness of 44.2% TPR @1 1%FPR The Infinity-8B shows only partial robustness, which is further discussed in Section
Table 4: BitMark is robust against the watermarks in the sand attack 42 detection results of our watermarking scheme (ō = 2) before and after the attack. We use 200 iterations, and generate 100 candidates during each itcration.
We present the
Accuracy (%)
AUC (%)
TPR I&FPR (%)
Green Fraction (%)
Threshold @ 1%FPR
Setting
Original Image
49,7
0.2
Watermarked Image (before altack)
100.0
100.0 99.8
100.0
57.6
87,8
59.6
Watermarked Image (after attack)
98.5
89.0
50.9
10.8
6.8
Robustness against Watermarks in the Sand Attack, We also evaluate the robustness of our watermarking scheme against the attack proposed in (42), namely, the watermarks in the sand attack. The attack leverages the CLIP Score as quality oracle, the daaleediiffusionn2-bar [2 as
8

---

perturbation oracle, and iteratively modifies the watermarked image to remove the watermark. During each iteration, the attack produces potential candidates by inpainting randomly masked regions in the image. The attack successfully replaces most visual details in the original watermarked image while selecting the candidate with the best CLIP Score. As a result, many watermarks for diffusion models (e.g., (9) can be removed through this attack. However, results in Table g show that our proposed method achieves a significant detection rate with TPR @ %FPR of 89.0%. Although a large percentage of the green-list patterns removed, the average z-score in the attacked images is still as high as 10.8, which remains significant when compared with a mean z-score of 0.2 for non-watermarked images. Moreover, the attack causes quality loss of the image when compared to the original image generated by Infinity. With 200 iterations and 100 candidates during each iteration, the method further requires a high computational cost, where more than 12 minutes are needed to attack a single image in the environment specified in Section F.2 We note that the results do not conclude the failure of the theoretical framework in watermarks in the sand, but rather that there currently no successful instantiations of the perturbation oracles and quality oracle for Infinity that remove proposed watermark. A more detailed analysis can be found in Section H.2
Robustness Against our Novel Bit- Flipper Attack. We further demonstrate that, even giving the attacker much stronger knowledge than our threat model formu- lated in Section 3] BitMark cannot be erased even with severe image degradation. Concretely, we assume the attacker is given the knowledge of the auto-encoder of the generative model, the watermark embed- ding and detection algorithms, and even our red and green lists. We propose novel Bit-Flipper attack tailored for this broader attack surface, aiming at removing our wa- termarks. During this attack, the attacker first computes the total number of bit se- quences (s| and calculate the green fraction C//s|/ Then, the attacker randomly flips bits convert green bit sequences to red
1400
2.0, Med 9.4
6 2.2, Med = -0.49
1203
2.4, Med = 5.66
Number of Samples
Threshold [z]
1000
800
600
400
200
-40
-30
-20
-100
Figure 2: Bit-Flipper attack for 5
ones. The goal of the bit flipping is to reduce the green fraction to the level of non-watermarked images, which is 50%, as shown in Section F Specifically, the attacker computes the probability of flipping bit via flip factor é, such that sequence removal severity. detailed algorithm of our attack described Algorithm 5 As shown in Section H.T
(C/l=l) 0.5) Φ. whereas & determines the bit
2.2 has the most impact on detectability. However, randomly flipping bits comes with very high degradation in image quality, as shown in Figure I0] Due to the symmetric detection threshold |z|. if we destroy too many bit sequences in G, this further leads to the detectability of the watermark (see Section H.T).
4.3 Our BitMark Watermark Exhibits High Radioactivity
We demonstrate that BitMark exhibits high radioactivity, i.e., other generative models fine-tuned on our watermarked images also produce our bit patterns that are reliably detectable.
Formalizing Radioactivity. We denote by model M1 our original model that generates watermarked outputs with a watermarking method, e.g., our BitMark. These watermarked outputs might be used as training set for a second model M2. In the context of language models it has been shown, that there are watermarks that persist this process and remain detectable in the outputs of M2, a property referred to as radioactivity (31. This property enables the detection of generated content, even when it has been used to train subsequent models. However, recent findings indicate that this property does not hold for watermarks in image generative models, such diffusion models [7].
Training Setup. Given the extensive compute costs of training high-performant inage-eutoregressive models from scratch, we simulate full training by full fine-tuning the models. Therefore, we first generate 1,000 images with prompts of the MS-COC02014 [88 validation dataset with our BitMark embedded under a watermarking strength of ă 2. The watermarked outputs of M1 are then used to

---

Table BitMark exhibits strong radioactivity. We report the TPR@ 1%FPR (%).
Type of M1
Type of M2
Output of Mi
Output of M2
Infinity-2B
Infinity-2B Stable Diffusion 2.1
100.0 100.0
Infinity-2B
100.0
98.9
train (i.e,, in our approximative setup full fine-tune) the M2 model. We analyze two different settings, with the same M1 of Infinity-2B, namely: (I) the same modality setting, transfer to Infinity-2B and (2) the cross-modality setting, transfer to the Latent Diffusion Model (LDM) Stable Diffusion 2.1 [26). To test the radioactivity, we compute the TPR @ F&PR of output images of M2 and report them in T
BitMark is Highly Radioactive. Table highlights the strong radioactivity of our BitMark. When fine-tuning a model M2 of the same architecture, the watermark still detectable with 99. 117%%PP TPR @ 1%FPR. Even in the cross-modality setting, BitMark is still detectable with 98. 18.9%TPRG @1 1%FRR Dubiński et al. [7] attribute the lack of radioactivity of watermarks in LDMs to the encoding from the pixel space into the latent space and the -errriin--eoiiingg process while training M2.
However, our BitMark remains detectable despite the encoding and the noising-denoising process. The robustness of our watermark arises from slightly changing all parts of given generated image, including low-level and high-level features, which are then also partly adapted by M2. The observed results are in line with our robustness against CtrlRegen+ (see Table (). an attack which simulates noising and denoising in the latent space. BitMark's 's radioactivity is a very useful property that allows model owners to track provenance of their data and data generated based on it, even when this new data does not originate directly from their original model.
We additionally ablate the ratio of watermarked to clean data needed for our BitMark to become radioactive to the Inifinity-2B model in Table 6 Even when model M2 is trained on only 10% of our watermarked data, generates images with a clear bias towards our watermark distribution, resulting in high TPR of 22.7% at 1 1% FPR. We note that even slight bias is significant at the distribution level. To validate this claim, we apply a one-tailed Mann- Mann-Whitne Whitney test to determine if the z-score distribution of Mz-generated data is significantly larger than on M1 clean generated data. The test is significant with a p-value of 5. 5.6e-62 when M2 is trained on only 5% watermarked data, showing that our BitMark provides traceable signal across training cycles in settings where only small fractions of the training data are watermarked.
Table 6: Detection performance and statistical significance across fractions of watermarked data. U-test p-values (bottom row) for different fractions of
TPR @ 1 &FPR (top row) and watermarked data used for fine-tuning.
Meuie \\ p% of watermarked data
Clean model
0
10
25
50
100
@PR@ISFPP
1.0%
0.3%
1.0%
2.9%
22.7%
98.3%
100.0%
100.0%
Mann- Whiiney U Test (p-value)
0.999
0.999
0.999
5.6e-66
6.8e-209
A/
5 Conclusions
We present BitMark, the first watermarking framework for bitwise image autoregressive models. We show that our watermark can be efficiently embedded and detected, imposes negligible overhead on image quality and generation speed, while exhibiting a strong robustness against wide range of watermark removal attacks, including the strong watermarks in the sand and our own adaptive Bit-Flipper attack. Moreover, BitMark exhibits strong radioactivity, i.e., downstream models fine- tuned on our watermarked outputs consistently inherit and reproduce our bit patterns, which makes our watermark reliably detectable requiring only 5% watermarked data achieve a significant distributional shift. This is important for model owners to identify images derived from their own generated images, and exclude them from training of future model versions. Overall, BitMark not only sets new standard for watermarking in autoregressive image generation, but also provides critical defense against model collapse, contributing to further advancements in image generative models.
10

---

Acknowledgments and Disclosure of Funding
This work was supported by the German Research Foundation (DFG) within the framework of the Weave Programme under the project titled "Protecting Creativity: On the Way to Safe Generative Models" with number 545047250. Responsibility for the content of this publication lies with the authors. We would like to also acknowledge our sponsors, who support our research with financial and in-kind contributions, especially the OpenAl Cybersecurity Grant.
References
[1] Sina Alemohammad, Josue Casco- Rodriigz, Lorenzo Luzi, Ahmed Imtiaz Humayun, Hossein Babaei, Daniel LeJeune, Ali Siahkoohi, and Richard Baraniuk. Self-consuming generative models go MAD. In The Twelfth International Conference on Learning Representations, 2024.
URL https:://ppenreveew http:ppaarrrreeee.eeeeerrrr/aaa/ net.:eooumndd--hiiiii.......e
[2] Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, et al. Waves: Benchmarking the robustness of image watermarks. In International Conference Machine Learning, pages 1456-1499 1492. PMLR, 2024.
[3] Niyar R Barman, Krish Sharma, Ashhar Aziz, Shashwat Bajpai, Shwetangshu Biswas, Vasu Sharma, Vinija Jain, Aman Chadha, Amit Sheth, and Amitava Das. The brittleness of ai- generated image watermarking techniques: Examining their robustness against visual paraphras- ing attacks. arXiv preprint arXiv:2408. 10446, 2024.
[4] Franziska Boenisch. A systematic review on model watermarking for neural networks. Frontiers in big Data, 4:729663, 2021.
[5] Tu Bui, Shruti Agarwal, and John Collomosse. Trustmark: Robust watermarking and watermark removal for arbitrary resolution images. IEEE International Conference on Computer Vision (ICCV), October 2025.
[6] Sumanth Dathathri, Abigail See, Sumedh Ghaisas. Po-Sen Huang, Rob McAdam, Johannes Welbl, Vandana Bachani, Alex Kaskasoli, Robert Stanforth, Tatiana Matejovicova, et al. Scalable watermarking for identifying large language model outputs. Nature, 634(8035) 883,,,,, 2024.
[7] Jan Dubiáski, Michel Meintz, Franziska Boenisch, and Adam Dziedzic. Are watermarks for diffusion models radioactive? In The 1st Workshop GenAI Watermarking, 2025. URL https://openreeve:: www.:neenfnnnneee wiw.orrnnnnmiittttt//ott.ttc.
(8] Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, al. Scaling rectified flow trans- formers for high-resolution image synthesis. In Forty-first international conference on machine learning. 2024.
[9] Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The sta- ble signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEFF/CVF International Conference on Computer Vision (ICCV), pages 22466 22477, October 2023.
[10] Sam Gunn, Xuandong Zhao, and Dawn Song. An undetectable watermark for generative image models. In The Thirteenth International Conference Learning Representations, 2025. URL https: httpas::/pppevvveeeee
[11] Jian Han, Jinlai Liu, Yi Jiang, Bin Yan, Yuqi Zhang, Zehuan Yuan, Bingyue Peng, and Xiaobing Liu. Infinity: Scaling bitwise autoregressive modeling for high-resolution image synthesis. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2025.
[12] Shaozhe Hao, Xuantong LIU, Xianbiao Qi, Shihao Zhao, Bojia Zi, Rong Xiao, Kai Han, and Kwan-Yes K. Wong. BiGR: Harnessing binary latent codes for image generation and improved visual representation capabilities. In The Thirteenth International Conference on Learning Representations, 2025. URL httpp/////ppppeeeeeeeeeee//////s

---

[13] Chao Jia, Yinfei Yang, Ye Xia, Yi-Ting Chen, Zarana Parekh, Hieu Pham, Quoe Le, Yun-Hsuar Sung. Zhen Li, and Tom Duerig. Scaling up visual and laionnlanguage representation learning with noisy text supervision. In International conference on machine learning, pages 4904-499 49164 PMIR, 2021.
[14] Hengrui Jia, Christopher A Choquette-Choo, and Nicolas Papernot. Entangled watermarks as a defense against model extraction. arXiv preprint arXiv:2002. 22200002.22200 /2200, 2020.
[15] Nikola Jovanović, Robin Staab, and Martin Vechev. Watermark stealing in large language models. In International Conference on Machine Learning, pages 22570-22593, PMLR, 2024.
[16] John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, lan Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning, pages 17061-17084. PMLR, 2023.
[17] Linyang Li, Botian Jiang, Pengyu Wang, Ke Ren, Hang Yan, and Xipeng Qiu. Watermarking Iims with weight quantization. In Findings of the Association for Computational Linguistics: EMNLP 2023, pages 3368-3378, 2023.
[18] Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitick. Microsoft coco: Common objects in context. In Computer vision-ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, proceedings, part 13, pages 740-755. Springer, 2014.
[19] Aiwei Liu, Sheng Guan, Yiming Liu, Leyi Pan, Yifei Zhang, Liancheng Fang. Lijie Wen, Philip S. Yu, and Xuming Hu. Can watermarked LLMs be identified by users via crafted prompts? In The Thirteenth International Conference Learning Representations, 2025. URL f htt.//oummdddu//yppaaaa
https://opents
net/
[20] Yepeng Liu, Yiren Song, Hai Ci, Yu Zhang, Haofan Wang, Mike Zheng Shou, and Yuheng Bu. Image watermarks are removable using controllable regeneration from clean noise. In The Thirleenth International Conference on Learning Representations, 2025. URL https:
//openreview. (igparrerieee.eetffommiieeeeeeee
[21] Subhadip Maji and Smarajit Bose. Deep image orientation angle detection. arXiv preprint arXiv:2007.06709, 2020.
[22] K.A. Navas, Mathews Ajay, M. Lekshmi, Tampy Archana, and M. Sasikumar. Dwt-dct-svd based watermarking. pages 271 274, 02 2008. ISBN 978-1-4244-179644 doi: 10. 1099 COMSWA.2008 45544442..
[23] Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis. arXiv preprint arXiv:2307.01952, 2023.
[24] Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea Voss, Alec Radford, Mark Chen, and Ilya Sutskever. Zero-shot text-to-image generation. In International conference on machine learning, pages 8821-8831. Pmlr, 2021.
[25] Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical lext-conditional image generation with clip latents. arXiv preprint arXiv:2004.06/25, 2022.
[26] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björ Ommer. High- resolution image synthesis with latent diffusion models. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022.
[27] Mehrdad Saberi, Vinu Sankar Sadasivan, Keivan Rezaci, Aounon Kumar, Atoosa Chegini. Wenxiao Wang, and Soheil Feizi. Robustness of Al-image detectors: Fundamental limits and practical attacks. The Twelfth International Conference on Learning Representations, 2024.
URL htt.:p/aweeeeeeeeeeeeooooooooaaa
[28] Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, and Hervé Jégou. Radioactive data: tracing through training. In International Conference on Machine Learning, pages 8326-8333 PMLR, 2020.
12

---

[29] Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Bureu Karagol Ayan, Tim Salimans, al. Photorealistic text-to-image diffusion models with deep language understanding. Advances in neural information processing systems, 35:36479-36494 2022.
[30] Tom Sander, Pierre Fernandez, Alain Durmus, Matthijs Douze, and Teddy Furon. Watermarking makes language models radioactive. Advances in Neural Information Processing Systems, 37: 1177922111,, 2024.
[31] Tom Sander, Pierre Fernandez, Alain Oliviero Durmus, Matthijs Douze, and Teddy Furon. Watermarking makes language models radioactive. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024.
qGizQb1Khm
[32] Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, et al. Laion- 5b: An open large-scale dataset for training next generation image-text models. Advances in neural information processing systems, 35:25278 -55294, 2022.
[33] Ilia Shumailov, Zakhar Shumaylov, Yiren Zhao, Nicolas Papernot, Ross Anderson, and Yarin Gal. Ai models collapse when trained on recursively generated data. Nature, (8022):) 755-759, 2024.
[34] Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical photographs. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2117-2126, 2020.
[35] Keyu Tian, Yi Jiang, Zehuan Yuan, Bingyue Peng, and Liwei Wang. Visual autoregressive modeling: Scalable image generation via next-scale prediction. Advances in neural information processing systems, 11844839-84865 2024.
[36] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention all you need. Advances in neural information processing systems, 30, 2017.
[37] Ze Wang, Hao Chen, Benran Hu, Jiang Liu, Ximeng Sun, Jialian Wu, Yusheng Su, Xiaodong Yu, Emad Barsoum, and Zicheng Liu. Instella-t2i: Pushing the limits of 1d discrete latent space image generation. arXiv preprint arXiv:2506.21033 2025.
[38] Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings water- marks: Invisible fingerprints for diffusion images. In A. Oh, T. Naumann, A. Glober- son, K. Saenko, M. Hardt, and S. Levine, editors, Advances in Neural Informa- tion Processing Systems, volume 36, pages 58047-58063. Curran Associates, Inc., 2023. URI. https::/pprocedddieeee neurips. wwwwrip..c.ppapprr..rr. cappappr_r.... http//paperrlsss_//llaaaaaaapeep wwwes//appeleeeeeeee hatps/ppar/222///eeeee 25441177779902220000066622221111 Papeee Ceee--ooffeeeeee pdf
[39] Bram Wouters. Optimizing watermarks for large language models. In Forty-first International Conference Machine Learning, 2024.
[40] Sierra Wyllie, Ila Shumailov, and Nicolas Papernot. Fairness feedback loops: training on synthetic data amplifies bias. In Proceedings of the 2024 ACM Conference on Fairness, Accountability, and Transparency, pages 2113-2147, 2024.
[41] Qihang Yu, Ju He, Xueqing Deng, Xiaohui Shen, and Liang Chich Chen. Randomized autore- gressive visual generation, 2024, URL https: /ttps://arxxv. org. httg/abs/4411..077
[42] Hanlin Zhang, Benjamin I. Edelman, Danilo Francati, Daniele Venturi, Giuseppe Ateniese, and Boaz Barak. Watermarks in the sand: impossibility of strong watermarking for language models. In Forty-firs International Conference Machine Learning, 2024.
[43] Kevin Alex Zhang, Lei Xu, Alfredo IIfante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. 2019.
13

---

[44] Ruisi Zhang, Shehzeen Samarah Hussain, Paarth Neckhara, and Farinaz Koushanfar. Remark- Ilm: A robust and efficient watermarking framework for generative large language models. In 33rd USENIX Security Symposium (USENIX Security 24), pages 1813-18.3 2024.
[45] Yiming Zhang, Javier Rando, Ivan Evtimov, Jianfeng Chi, Eric Michael Smith, Nicholas Carlini, Florian Tramèr, and Daphne Ippolito. Persistent pre-training poisoning of LLMSs. In The Thirteenth International Conference on Learning Representations, 2025. URL https
/ loopenreviee.ne//forrooooo net//forumiideeiqrni/
[46] Xuandong Zhao, Prabhanjan Vijendra Ananth, Lei Li, and Yu-Xiang Wang. Provable robust watermarking for Al-generated text. In The Twelfth International Conference on Learning Representations, 2024. URL htttt::
wwt. htte:/oorrmm111dmmmma55555555
[47] Yue Zhao, Yuanjun Xiong, and Philipp Kraehenbuehl. Image and video tokenization with binary spherical quantization. In The Thirteenth Internationnal Conference on Learning Representations. 2025.
eviee. net www.eeeeeeeetoeneeeeeeee fett/fooommidddynsStaaa_..
[48] Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Ngai-Man Cheung, and Min Lin. A recipe for watermarking diffusion models, 2023.
A Limitations and Broader Impact
Limitations. While BitMark for Infinity-2B is robust against moderate rotations (99.9% TPR@ 1&FPR within rotation angles -20" to 20%), the detection accuracy degrades with larger rotation angles, dropping to 56.8% TPR@ I 1&PP for #50 rotations. Although open-source methods have a strong capability for rotation correction, this can be a limitation for real-world scenarios. This rotation sensitivity, however, an inherent issue in Infinity's s data augmentation pipeline, which makes the autoencoder less robust to large rotations. Moreover, the soft biasing parameter ó requires tuning, as values exceeding to 127.44 when 8 increases from 3 to 5), constraining the maximum achievable watermark strength. Although we evaluate the detection BitMark with a commonly adopted metric, iee., true positive rate at very low false positive rates (1%), it could potentially become problematic in extreme-scale applications involving trillions of samples, where even small false positive rates might impact training data quality. It is observed that the Infinity-8B checkpoint shows increased sensitivity to larger values of 6. We hypothesize that the lower 8 chosen may account for its comparatively lower robustness relative to the Infinity-2B checkpoint, as illustrated in Table 2
lead noticeable quality degradation (FID increases from 29.61
Broader Impact. Image generative models have the capabilities of generating photorealistic images, which are near imperceptible to human generated content. BitMark provides method to watermark the content, without harming image generation capabilities of the model and allows for provenance tracking of generated images for models hosted under private API. It supports the defense against model collapse, when training a model on data generated by itself.
B Additional Related Work
LLM Watermarking. Here, we review more related work regarding the LLM watermarking, which build upon in our method. Beyond the soft biasing approach proposed by KGW (16), SynthID-Text (6) introduces tournament sampling during the model inference to enhance watermark detectability. This sampling strategy modifies the token sampling process to embed watermark signals. However, tournament sampling is only applicable to autoregressive models with large vocabulary sizes, making it incompatible with the binary bit sampling process used in Infinity. There are also works that incorporate watermarks by training or finetuning the models. For example, REMARK-LLM trains a learning- based encoder for watermark insertion and decoder for watermark extraction, while using a reparameterization module to bridge the gap between the token distribution and the watermark message [44). Moreover, potential malicious transformations are incorporated into the training phase to enhance the robustness of the watermarking. Although effective, these training- methods require substantial computational resources and time. Therefore, we focus on inference-tine time watermarking methods that can be applied to Infinity without any retraining.
14

---

Sander et al. 30 investigate the radioactivity of LLM watermarking, which is the ability of water- marks to transfer across different model architectures. They design a specific protocol for amplifying the watermark signals after transferring across models. The radioactivity of watermarks also falls into the scope of our work, as our proposed watermark exhibits significant radioactivity across various model architectures. Regarding the undetectability of the watermark, recent studies show that the biases between watermarked and non-watermarked outputs from the LLM are identifiable with carefully designed prompts [19]. As specialized application of LLM watermarking, Li et al. 17 design watermarking scheme tailored for quantized LLMs. The proposed watermarks are only detectable on quantized models while remaining invisible for full full-precision models.
With the fraction of artificial generated content within the World Wide Web increasing, Shumailov et al. [33] investigate the phenomenon of model collapsing, which is defined as the decrease of generation quality when models are recursively trained on (partly) generated data. This decrease in generation quality is mainly characterized in overestimating probable events and underestimating low-probability events, as well as recursively adding noise (i.e., errors) which is generated during earlier model generations. Hence, this generated data is polluting future datasets, decreasing the potential quality of successor models and therefore highlighting the necessity to distinguish human- from artificial-generann data. BitMark mitigates model collapsing by robustly watermarking generated images to exclude said marked images from future datasets.
Model Collapse.
C Application of BitMark on Single-Scale models
We report the application of BitMark for single scale models in Algorithm 3 and the detection in Algorithm 4
We report the functions used in Algorithm T
Algorithm 2
Algorithm
3 and Algorithm 4 here:
Bias: Addition of the bias ō to the current logit le based on the green list G.
Sample: Use the probabilities in Pe sample the returned bit, either 0 1.
Lookup: Perform the BSQ lookup [47] return the quantized states.
Interpolate: Scaling to target resolution.
Count: Counts the number of bits which are part of the green list.
Algorithm 3
Watermark Emhedding
Algorithm 4 Watermark Detection
Inputs: autoregressive model fo with parameters 6, green list G. red list R. image decoder D. Hyperparameters: the number tokens r, constant ó added to the logits of the green list bits, n the length of the bit sequences in the lists (G and R), the number of bits per token.
Inputs: raw image im, green list G, red list R, image encoder &, quantizer Q
Hyperparameters: the number tokens r, n- the length of the bit vector.
Eim)
C 0
for 1, ......
u, ((c)
for j = n, m do
0, = (bi,..., br-m)
e (t
m + //contter
C = Count((b1,..... by-m), G)
Bias G, Le, 8)
Return: StatisticalTest(Ho.. (C))
Softmax (p.)
be Sample
(bI...., br.m) (u))up(u.) im= = D(e)
Return: watermarked image im
D Green and Red List Selection
Consistency Longer Sequences. We analyze the overlap of bit sequences with growing size in Figure 3 which shows that with increased length of the sequence, the consistency of the pattern decreases. This has a direct impact on the choice of n, as it shows that larger n lead to less overlap, reducing the impact of BitMark which is already noticeable for 3 (see Table 7).
15

---

Selection of Red and Green Lists. The re-encoding loss presented in Section 3.1 choice of small length of the green list n, larger consecutive bit sequences are more likely be interrupted. Additionally, this auto-encoder has the property of re-encoding images towards an equal frequency of 0's and I's, so it not efficiently possible bias each bit towards either 1, making the choice of = 1 unpractical (see Table 7 Thus we leverage the second smallest possible choice, n 2, resulting in 6 possible choices to separate and R by keeping |G] -
also motivates the
As we have the constraint to not bias towards 0 or 1, as this type of pattern is more likely removed by the auto-encoder, and given the constraint shown that the same prefix must not be in the same list twice as discussed in Section 3.2 the most effective G for BitMark are G {01, 10) and G {00, 11]. We choose G {01, I0) throughout all experiments.
Changing the Length of the Bit Se- quence. We additionally ablate the size of the bit sequence in Table 7 For each sequence size n, if both lists should have the same size, we choose 2- out of 2" possibilities without replacement, so there are (g=- possibilities of construct- ing the G and R. For the 2-bit sequences, flipping the green and red list has only limited impact on the final z-score, thus for the 3-bit sequences we only analyze all unique choices, i.e., we do not inter- change green and red list, leaving with 35 distinct possible green and lists. For = 3. two G have similar com- pared to the best 2-bit sequences. These choices have the same properties dis- cussed above, namely (1) they equally often bias towards 0 and 1 and (2) none of the sequences share the same prefix, i.e. the biasing is always effective.
Overlap (%)
I
40%
20%
0%
Sequence Length
Figure Longer sequences are less consistent after re-encoding. We analyze the consistency of sequences of length n after re-encoding over the whole image, follow- ing the setup of Figure]
E Experimental Setup
E.1
Hyperparameters
For the experiments radioactivity, chose 1,000 prompts from the MS-COCO 2014 validation dataset, generated the respective number of images with the M, Infinity model and then fine-tuned the second model M2 for 5 epochs with learning rate of 10 - and a batch-size of (batch-size of for Infinity-2B).
Since VAR B35 and RAR 41 class-conditional models for the ImageNetlk dataset, first generated ImageNet fakes using Infinity-2B with the ImagenNet class name and "A photo of (class name)" " prompt. We used the same hyperparameters such as batch-size, number of epochs and learning rate consistent with the experiments on Infinity-2B and Stable Diffusion 2.
E.2
Environment
Our experiments are performed on Ubuntu 22.04, with Intel(R) Xeon(R) Gold 6330 CPU and NVIDIA A40 Graphics Card with 40 GB of memory.
16

---

Table 7: Green and Red list selection. We analyze all possible green and red lists for n and n = 3 with = 2 and 1,000 images. We also report the fraction of I's that are in the bit representation during generation of the image (Is Gen) and after re-encoding the image using the image encoder (Is Enc).
Green List G
Red List R
Average Z-Score
1s Gen
Is Enc
[1]
6.18
31.50%
49.47%
{1)
{0]
2.39
64.52%
50.21%
{11,00)
[01,
91.35
49.74%
49.98%
{01,10)
{00,
90.33
49.97%
49.99%
100,10)
{01,
6,52
31.85%
49.44%
(11,01)
10)
2.56
63.70%
50.22%
010
[10
0.25
49.92%
49.98%
[0]
(00,01}
-0.25
49.92%
49.98%
{000, 011, 100, 111)
101,
88.00
49.75%
49.98%
000, 111
000,,010,000,
87.91
49.75%
49.98%
010, 111
[001,010, 100,
67.90
49.75%
49.98%
(000,
0001,01,,01,1100
44.95
40.92%
49.52%
(000, 00,,
101,
32.91
58.19%
50.24%
(000, 00,,
101,,
32.85
44.09%
49.68%
0000,010 010,
100, 101,
29.04
40.92%
49.52%
(000, 100, 101,
011,
29.04
40.92%
49.52%
(000,
011,,01,,011,1100
26.43
40.92%
49.52%
001, 101,
20.11
49.75%
49.98%
100, 101,
10.03
58.19%
50.24%
00,,
10,, 111
8.72
58.19%
50.24%
010,
10,,
6.48
44.09%
49.68%
0000,
001,
6.20
33.07%
49.48%
0000,
101,
5.99
33.07%
49.48%
010,
10,,
5,55
40.92%
49.52%
001,
101,
3,74
44.09%
49.68%
001,011, 10,,
3.21
33.07%
49.48%
010,
101,
2.93
40.92%
49.52%
1000, 10,,
001,010,011,
2.93
40.92%
49.52%
100,
001,011, 110
2.14
33.07%
49.48%
(000, 100,
010, 111}
0.25
49.92%
49.98%
(000, 00,, 011
100, 111)
0.25
49.92%
49.98%
(000,011; 011,
010, 111
0.11
49.75%
49.98%
101,
100,
0.07
49.92%
49.98%
000, 111
0.02
49.75%
49.98%
1000, 001, 110
011,
-0.05
49.92%
49.98%
101,
100,0011,100, 110
-0.26
49.92%
49.98%
000,
101,
-0.37
49.92%
49.98%
101,
0100
-0.55
49.92%
49.98%
010
000,,011,000,
-0.65
33.07%
49.48%
(000, 010,
(001,011,
-0.85
33.07%
49.48%
(000, 011,
1010,100,,10,111
-1.45
58.19%
50.24%
0100,010,111,
1001,100,110,111
-12.98
40.92%
49.52%
0000,
101,
-13.39
44.09%
49.68%
17

---

F
Additional Experiments
In this Section ablate the behavior of BitMark the Infinity-2B model.
F1
Scalewise Analysis of BitMark
Next, we analyze the scalewise impact of BitMark during image generation. Rable@ddepicts informa- tion about the generation of images with Infinity-2B,, averaged over 10,000 images. It shows that the entropy is low earlier scales, meaning the bits are chosen with high certainty these depend more on the input prompt, but large on later scales, which means sampling either of the possible values for the bit can lead to different, but both high-quality content.
Table 8: Statistics regarding the infinity generation process for 10,000 images. Entropy, Green Fraction& Re- Encoding Loss are relative values. The Re- Encoding Loss displays the number of bits changed during receding. We report the mean (std) for all values.
Number of
Scale
Entropy
Green Fraction
Re-Encoding Loss
Tokens (Bits)
1
0.051 (0.037)
0.01 (0.876)
0.501 (0.079)
0.068 (0.063)
(32)
2
0.108 (0.044)
-0.195 (1.114)
0.491 (0.049)
0.132 (0.063)
4 (128)
3
0.133 (0.034)
-0.463 (1.226)
0.49 (0.027)
0.145 (0.041)
16 (512)
4
0.178 (0.029)
-0.522 (1.217)
0.492 (0.018)
0.2 (0.031)
36 (1,152)
5
0.202 (0.024)
-0,558 (1.199)
0.494 (0.013)
0,226 (0.024)
64 (2,048))
6
0.215 (0.021)
-0.663 (1.229)
0.495 (0.009)
0.247 (0.02)
144 (4.608)
7
0.223 (0.019)
(1.266))
0.497 (0.007)
0.239 (0.017)
256 256 (8,192)
8
0,223 (0.015)
-0.349 (1.187)
0.498 (0.005)
0.277 (0.016)
400 (12,800)
0.226 (0.014)
-0.122 (1.13)
0.5 (0.004)
0.279 (0.014)
576 (18,432)
10
0,243 (0.014)
0.157 (1.165)
0.5 0.5 (0.003)
0,264 (0.012)
1,024 (32,768)
11
0.237 (0.012)
0.227 (1.161)
0.501 (0.003)
0.319 (0.011)
1,600 (51,200)
12
0.233 (0.012)
0.329 (1.198)
0.501 (0.002)
0.328 (0.01)
2,304 (73,728)
13
0.234 (0.014)
0,462 (1.173)
0.501 (0.002)
0.212 (0.012)
4,096 (131,072)
1-13
0.193 (0.012) 0.232 (1.644)
0.497 (0.008)
0.266 (0.009)
10,521 (336,372)
Table 9: Statistics regarding the infinity generation process with BitMark applied all scales for 10,000 images, 8 = 2. Entropy, Green Fraction, Re-Encoding Loss & Changed Bits are relative values. The Re-Encoding Loss displays the number of bits changed during re-encoding, whereas Changed Bits display the number of bits changed during the generation process. We report the mean (std) for all values.
Scale
Entropy
Green Fraction
Re- Ercodndding Loss
Changed Bits
1
0.051 (0.037)
0.218 (0.897)
0.52 (0.081)
0.088 (0.076)
0.09 (0.077)
2
0.108 (0.043)
0.854 (1.105)
0.538 (0.049)
0.181 (0.079)
0.179 (0.075)
3
0.132 (0.032)
2.37 (1.452)
0.552 (0.032)
0.2 (0.053)
0,208 (0.05)
4
0.175 (0.028)
3,965 (1.613)
0.558 (0.024)
0.26 (0.037)
0.279 (0.042)
5
0,2 (0.024)
6.252 (1.812)
0.569 (0.02)
0.286 (0.029)
0.313 (0.035)
6
0.213 (0.021)
10.118 (2.304)
0.575 (0.017)
0.305 (0.022)
0.329 (0.029)
0.224 (0.019)
15.701 (2.832)
0.587 (0.016)
0.3 (0.02)
0.346 (0.027)
8
0.224 (0.016)
16.247 (2.788)
0.572 (0.012)
0.329 (0.016)
0.345 (0.022)
9
0.228 (0.015)
20.876 (3.341)
0.577 (0.012)
0.333 (0.013)
0.351 (0.02)
10
0.244 (0.015)
32.837 (5.104)
0.591 (0.014)
0.319 (0.011)
0,373 (0.019)
11
0.237 (0.013)
29.535 (5.06)
0.565 (0.011)
0.361 (0.009)
0.363 (0.017)
12
0.242 (0.013)
34,973 (6.681)
0.564 (0.012)
0.37 (0.008)
0,368 (0.017)
13
0.247 (0.014)
64.333 (11.823)
0.589 (0.016)
0.256 (0.015)
0.374 (0.019)
1-13
0.194 (0.012)
90.784 (14.852)
0.566 (0.013)
0.312 (0.009)
0.366 (0.017)
Table depicts using BitMark with 8 2. Applying BitMark changes up to 37% of bits per scale, yet the re-encoding loss only increases by 5% compared to the non watermarked images. Table [0] further shows the correlation between different analyzed factors. As expected, there is a high correlation between changed bits and entropy, as due to the soft-biasing mostly change bits of low entropy.
18

---

Table 10: Correlations of different factors when applying BitMark on all scales within the Infinity generation process. Entropy, Green Fraction, Changed Bits & Re-Encoding Loss are relative values. The Re-Encoding Loss displays the number of bits changed during re-encoding, whereas Changed Bits display the number of bits changed during the generation process. 10,000 images, 6 2.
Entropy
Changed Bits
Green Fraction
Changed Bits
0.999
0.706
0.689
Green Fraction
0.918
0.917
0.642
Re-Encoding Loss
0.926
0.931
0,475
0.751
We further observe that the model produces high-level information in the image during the initial scales, forming coarse shape of the main visual components, such as the object and the background (see Figure(5) In larger scales, the model predicts the details of the image (see Figure Table [1] earlier and late scales contribute differently to the robustness of BitMark. Earlier scales are more robust against like CirlRegen+, as CtrlRegen+ does not change the content of the image itself, but mostly high level features.
shown in
Table 11: Robustness of BitMark applied to different scales with 5 = 2. We report the TPR F&PR (%) for the different attacks on 5,000 watermarked images.
Conventional Attacks
Reconstruction Attacks
Scales
None
Noise
Blur
Color
Crop
Rotation
JPEG
SD2.1-VAB CtrlRegen+
100.0
97.9
98.7
97.6
61.6
15.0
100.0
100.0
82.1
11-13
100.0
96.7
98.6
99.5
20.0
9.8
100.0
100.0
15.5
1-13
100.0
99.6
99.9
99.8
98.8
20.1
100.0
100.0
91.6
F2
Robustness
Table 12 shows an ablation of the robustness of BitMark given different values of 8. BitMark achieves
high TPR @ F%PR against most attacks even for a low watermarking strength 5 = 1. While stronger robustness can achieved with higher d values, there is a direct tradeoff with the image quality, which we show qualitatively in Figure
Table 12: BitMark is robust against watermark removal attacks. We report the TPR @ 1%FR (%) for the different attacks and baselines.
Conventional Attacks
Reconstruction Attacks
8
None
Noise
Blur
Color
Crop
Rotation
JPEG
SD2.1-VAE
CirlRegen+
1
100.0
97.8
99.2
99.3
68.5
14.5
100.0
100.0
61.9
100.0
99.6
99.9
99.8
98.8
20.1
100.0
100.0
91.6
100.0
99.7
99.9
99.9
99.8
23.8
100.0
100.0
97.0
4 100.0
99.9
99.9
100.0
99.9
29.2
100.0
100.0
99.0
5
100.0
100.0
100.0
99.9
100.0
34.3
100.0
100.0
99.8
We ablate the robustness of BitMark against different degrees of rotation and different watermarking strengths 5. We find that with 8 2 BitMark is robust for rotation degrees +:30.
Rotation.
Additionally we find an increase in TPR@ %FPR for a rotation of 180"
We further show the improved detection performance leveraging rotation estimation tool 21 in Table [3] After re-rotating the image, the detection performance increases from TPR & 1%FPR=0. 184 to TPR @ &FPR=00983. In addition, we consider even harder case: after the random rotation, we apply central crop the image with 50% cropping ratio, such that all the black corners during rotation are completely removed. We show the results in Table 14
19

---

TPRg ISPPR, 6-1
1SFPA, 6-2
TPRg 18PP8, 6=3
0.8
TPRg 15PPP, 6-4
TPR@1 TPR@1%FPP 1%FPR
0.2
Degree
Figure 4: BitMark is robust against rotation within 330 degrees. The TPR@ 1%FPR for different ò and rotation degrees.
Table Impact rotation correction on detection performance. Images are randomly rotated between 0 and 360".
Setting
AUC (%)
Accuracy (%)
TPR @ 1%FPR (%)
Green Fraction (%)
No rotation correction
60.4
60.8
18.4
50.2
After rotation correction
99.5
99.2
98.3
52.0
Table 14: Impact of rotation correction and cropping on detection performance. Images are randomly rotated between 0f and 360 with 50% center crop. Setting
AUC (%)
Accuracy (%)
TPR @ 1%FPR (%)
Green Fraction (%)
No rotation correction
59.8
58.9
9.9
50.1
After rotation correction
89.1
86.5
66.3
50.5
F33 Image Quality
Table 15 shows that our chosen biases does not negatively impact the image quality for Infinity-2B
(8 2), In (5 1.5) and Instella IAR (5 1.5)
Additionally, we qualitatively analyze the impact of applying BitMark with different ó values. Figure 7 shows that applying BitMark with 8 < 3 keeps the semantic structure and quality of the image the same, while changing small features, e.g., the color of the train the first row. For larger watermarking strengths, the image quality starts to deteriorate, where artifacts become visible in the final image.
Table 15: BitMark does not decrease the image quality. Changes in FID, KID and CLIP relative non-watermarked images.
Model
AFID
AKID
ACLIP
Infinity 2B, = 2
16.1169
-0.0016
0.1086
Infinity 8B, 1.5
0.5299
-0.0018
0.2792
Instella IAR, 5 = 1.5
1.1471
0.0004
-0.8361
E4 Timing
present average elapsed time (in seconds) for the generation an image with Infinity, when the watermark is applied to all scales (resolutions) and when using the standard generation process (without watermark). For hardware information refer to Section E.2 Table T6 shows that BitMark results in negligible overhead to image generation and allows for fast detection under 0.5 seconds.
20

---

Table 16: Timing results for image processing and detection per image. We report the mean (std)
for 1,000 images.
BitMark
No watermark
Detection
Seconds/Image
2.5817 (0.0063) 2.3196 (0.0043) 0.4491 (0.0046)
F55 Radioactivity to IARs
Table 17: We analyze the radioactivity of BitMark for class-conditional autoregressive models. report the @ 1&FPR (%).
Type of M1
Type of M2
Output of M1
Output of M2
Infinity-2B
VAR-16
100.0
24.2
Infinity-22 2B
VAR-20
100.0
25.8
Infinity-2B
VAR-24
100.0
25.7
Infinity-2B
VAR-30
100.0
25.6
Infinity-2B
RAR-B
100.0
4.3
Infinity-2B
RAR-L
100.0
3.3
Infinity-2B
RAR-XL
100.0
3.9
Infinity-2B
RAR-XXI.
100.0
4.1
Table 17 reports the radioactivity of BitMark for the class-conditional autoregressive models, namely, which operates in the multi-scale manner similarly Infinity, and RAR [41), which generates tokens only on a single scale in an autoregressive fashion. We find that BitMark ex- hibits detectable traces of radioactivity for the class-to-image autoregressive models models with TPR>> 1 % @ FPR=1% %, with slightly lower traces for RAR (probably due to its single scale genera- tion) than VAR. A potential cause of the overall relatively lower radioactivity for VAR and RAR is stemming from the class-conditional setting, instead of the text-to-image setting as in Infinity. +
VAR 35
F.6 Natural Images
To ensure the validity of our hypothesis we compute the average number of members of the green list and for natural images from different datasets, as well images generated for the non- watermarked Infinity model. Table 18 shows that indeed, the green fraction for non- waterrarmareed images is 50%.
Table 18: Detection on non-watermarked samples. Mean (std) of and green fractions for 1,000
non-watermarked samples.
Dataset
Green Fraction
Imagenet
0.6311 (1.966)
0.5005 (0.0017)
MS-COC02014
0.6773 (1.735)
0.5006 (0.0015)
Infinity-2B generated
0.3620 (1.641)
0.5003 (0.0014)
We additionally show the FPR for different natural datasets (ImageNet-Ie 1k, LAION POP) and Infinity- 2B generated images, given the 1%PP threshold that we used for MS-COCO Table 19
Table 19: False Positive Rate of choosing the MS-COCO % FPR threshold on different datasets. FPR measured on N=1000 non- watermarked samples.
Dataset
FPR @ 1&MS-COCO
MS-COCO
0.01
ImageNet-Il llk
0.011
LAION POP
0.021
Infinity-2B Generated
0.0
21

---

G Generalization to Diffusion
Additionally to the bitwise autoregressive image modeling that we explore in Section we extend our BitMark to bitwise diffusion models, namely BiGR [12]. We employ two variations of BiGR, the L-256x256 with 24 bits token and L-512x512 which leverages 32 bits per token. We set the Gumbel temperature 0.01, the cfg to 2.5, the number of iterations as well the diffusion timesteps to 10 each. We further notice that the detection performance for BiGR increases greatly if, before encoding, slight amount of noise added to the image.
In Table 20 we show that BitMark has negligible impact on the quality of the generated images for both BiGR model sizes. We use 5,000 MS- MS-COCO prompts to generate both BiGR clean and watermarked data. On these images we then compute image quality metries FID, KID and CLIP. The difference in FID and KID score shows that the watermarked images have lower FID and KID, sign of more similarity to the MS-COCO baseline images. The CLIP score only increases slightly, showing only minor impact of BitMark to the prompt following capabilities of the model.
Additionally we show the robustness of BitMark in Table 21] achieves significant TPR 1%FPR for all attacks. Especially against the advanced reconstruction attack BitMark achieves 75.2 and 69.2% TPR @ %FPP at resolution of 256 x 256 and 512 x 512, respectively. We note that, BiGR generates smaller images with only 256 1024 tokens, leading lower robustness compared to the Infinity-2B and 8B model.
Table 20: BitMark does not decrease the image quality. Changes in FID, KID and CLIP relative to non-watermarked images.
Model
AFID
AKID
ACLIP
BiGR 256x256, d=
-3.0304
-0.0020 -0.0024
0.0017
BiGR 512x512, 8 == 3 -3.6660
0.1329
Table 21: Watermark robustness against removal attacks. We report the robustness (%TPR@) 1 (FPR) for the different attacks. For BiGR, we added a slight amount of noise to all images before encoding.
Watermark
Conventional Attacks
Reconstmuction Attacks
None
Noise
Blur
Color
Rotate
Crop
JPEG
Vertical
Horioontal
VAE
Cirleegnn+
BIOR 256 256 (6
61.3 75.4
BIGR 512xx 512
3)
99.3
$7.4
96.4
34.2
65.1
69.4
97.6
77.2
98.2
69.2
H
Analysis of the Advanced Attacks
H.1
Analysis for the Bit-Flipper Attack
We present the pseudo code of the novel Bit-Flipper attack for multi-scale models in Algorithm 5 To apply the attack, we first encode the image into bits (line 1). During deconstructing the watermarked image, we construct a new attacked image. We recursively iterate through all scales K, retrieve the bit representations of the respective scale (line 4) and count how many bits are part of the green list and the red list (line 5). Then we define the probability of flipping a bit based on the green fraction and the flip factor ø. Next, we change the bits which are part of the green list based on the random probability p (line 8, 9). We follow the standard encoding and decoding process, to iterate through all resolutions of the image (line 10-13). Finally, return the decoded version of the attacked image.
Figure 9 shows different flipping strengths e for on 1,000 watermarked samples. The most effective o is Φ = 2.2 with a TPR @ FPR below 50% (see Table The decrease in image quality for Bit-Flipper for different & is shown Figure as well more detailed analysis of Φ = 2.2 on BitMark with 8 2 is displayed in Figure
22

---

Algorithm 5 Bit-Flipper Attack
Inputs: Image im, green list G. red list R. image decoder 2>.
Hyperparameters: Flip lactor 6, steps K (number of resolutions), resolutions (h,, w;) the number of bits for resolution la the length the bit vector, |s| total number bit sequences.
e = {im) img init()
for
1, ...., K do ((Interpolate(e: he, w:) C. Count(( (bi..... be, G)
p [P.] 0.5)
for n....... do
if (0g-n..... bj) E G random() < then
by bb (Flip bit with probability p if sequence is in green list)
Lookup(u, (4))
Interpolate 2s, lu,, wx) 6:(2,)
img img di (z.)
Return: attacked image D(img)
Table 22: Applying Bit-Flipper with different factors & on watermarked images with 2. report the TPR @ 1%FP for 1,000 Images.
TPR 1%PP (%)
1.8
0.878
10.06 (4.24)
2.0
0.845
9.17 (4.16)
2.2
0.472
5.52 (5.07)
2.4
0.595
8.06 (7.28)
2.6
0.52
6.97 (6.96)
H.2 Watermarks in the Sand Attack
As shown by the qualitative analysis in Figure 8 the watermarks in the sand attack causes a significant loss of details and produces many perceptible artifacts, limiting the applicability of this attack.
23

---

Original
Differonces
Scale
Scale
Scale
Scale
Figure 5: Visualization of different images different scales. The image scale refers the cumulative image obtained by adding up to i scales. We visualize five sets images: f) Original images without watermarking, 2) Watermarked (last 3), where the watermarks 11 to 13, 3) Differences (last 3), which is the difference between the original and watermarked images (last 3), 4) Watermarked (all), where the watermarks are generated all scales, Differences (all). which is the difference between the original and watermarked images (all), We visualize scales 1-7.
generated scale
24

---

Origital
Scale
Scale
Sowle
Scale 12
Scale 13
Figure 6: Visualization of different images different scales. The image scale refers to the cumulative image obtained by adding up 1 to scales. We visualize five sets images: 1) Original images without watermarking, 2) Watermarked (last 3), where the watermarks 11 to 13, 3) Differences (last 3), which is the difference between the original and watermarked images (last 3), 4) Watermarked (all), where the watermarks generated on all scales, Differences (all), which is the difference between the original and watermarked images (all). We visualize scales 8-13.
generated scale
25

---

40.71
102.22
106.14
46.48
104.15
123.85
Figure 7: Artifacts start to form in high detailed images already with 3. Qualitative analysis of the impact of the choice of watermarking strength (0) on the perceived image quality.
26

---

Original Images
Waterrarked Images
Watermarked Images (Zoom-in)
Attacked Images
Attacked Images (Zoont- in)
Figure 8: Watermarks in the Sand has non-negligible impact image quality. Qualitative analysis of the impact of the watermarks in the sand. Here, we zoom in on some regions in the image demonstrate the quality loss in details.
27

---

Watermark 6 2 Z 75.33
d= 1.8
④ = 2.2
Φ 2.6 -3.33
10.4
-0.55
2 = 76.86
== 11.19
== 1.5
=
Z 77.48
2 14.75
Z 4.22
=1.4
z 80.87
z 15.19
z 6.08
z= 1.72
Z 87.57
z 16.06
z 6.87
Z 2.39
Figure 9; A higher flip factor leads to worse image quality but better watermark removal. Qualitative analysis of the impact of the Bit-Flipper with different ø.
28

---

Original Images
Watermarked Images
Watermarked Imagea (Zoom-in)
Attacked Images
Attacked Images [Zoom-in)
Figure 10: The Bit-Flipper has strong impact on the image quality. Here, we zoom in on some regions in the image to demonstrate the quality loss in details. Φ = 2.2, 5 = 2.
29

---

NeurIPS Paper Checklist
1. Claims
Question:
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: We claimed developed watermark which is robust towards most state of the art attacks. It sets a new benchline for well established attacks, as well as outperforms current benchmarks regarding more advanced attacks like Watermark in the Sand CtrlRegen. We showed exhaustive empirical results as well as ablations in the appendix to support those claims.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals motivation long it is clear that these goals not attained by the paper.
Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
Yes, we pointed towards the limitation to bitwise domains as well as limitaitons
towards robustness regarding rotation. Further, limitations have been stated in Section
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g., independence assumptions, noiseless settings, model well-specification asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images taken in low lighting. Or speech-to-texx system might not be used reliably to provide closed captions for online lectures because fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't i acknowledged in the paper. The authors should use their best judgment and recognize that individual actions favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
30

---

Answer:
[NA]
Justification:
There are no theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross-referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper the supplemental material, but if they appear the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.
Inversely, any informal proof provided the core of the paper should complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main experi- mental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided not)?
Answer: [Yes]
Justification:
We stated our method in Section 3.2 and Section 3.3 and displayed all core algorithms (see Algorithm Algorithm Algorithm 5) well as settings and hyperparameters in Section E.] to reproduce these results.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary either make it possible for others replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of a large language model), releasing of model checkpoint, or other means that are appropriate to the research performed.
example, if the contribution
While NeurIPS does not require releasing code, the conference does require all submissions provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) If the contribution primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is new model (e.g., a large language model), then there should either be way to access this model for reproducing the results way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited some way (e.g., registered users), but it should be possible for other researchers have some path to reproducing or verifying the results.
Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, described in supplemental material?
31

---

Answer: [Yes]
Justification:
We provide access to the code in the supplementary material.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips htttps://nips.cc/publli cc/public/ guides/ Buiides/Codeeubmisssi..oo www.bbmmisioooooccyy..... for more details.
While we encourage the release of code and data, we understand that this might not be possible,
"No" is acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines pottts://nigge cc/pubicc/ Suudess/Codeeubmiise iss wwwsssssssliioooooooo
for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters. how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: See Section E.1 Section 4 and the provided supplementary material.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: All plots and tables contain the mean over the specified number of samples.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
It is OK to report 1 I-sigma error bars, but one should state it. The authors should preferably report 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
32

---

For asymmetric distributions, the authors should be careful not to show in tables or figures
symmetric error bars that would yield results that are out range (e.g. negative error rates). If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
Experiments compute resources
Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experi- ments?
Answer: [Yes]
Justification:
See Section F.2 for specification of the compute resources and environment.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
Code of ethics
Does the research conducted in the paper conform,, in every respect, with the NeurIPS Code Ethics
Question:
Answer: [Yes]
Justification:
The research is conform with the NeurlPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. if there a special consideration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
See Section A for a broader impact of the work.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
the authors answer NA or No, they should explain why their work has no socictal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g.. deploy- ment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied par- ticular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point out. For example, an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, not needed to point out that generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
legitimate to point out that
33

---

The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of MI.).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have high risk for misuse (e.g.. pretrained language models, image generators. or scraped datasets)?
Question:
Answer: [NA]
Justification:
The paper does not provide new models or datasets.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines restrictions access the model implementing safety filters.
Datasets that have been seraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.
12. Licenses for existing assets
Question: Are the creators original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: Model owners and used code are clear and properly cited.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, possible, include a URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
this information not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: The code for our method will be submitted as supplementary material and published upon acceptance of the paper.
Guidelines:
The answer NA means that the paper does not release assets.
34

---

Researchers should communicate the details of the dataset/code/moodl as part of their sub- missions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, applicable, as well as details about compensation (if any)?
Question:
Answer: [NA]
Justification:
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail possible should included in the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applica- ble), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is an important, original, non- standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA]
Justification:
Guidelines:
The answer NA means that the core method development in this research does not involve LLMMs as any important, original, or non-standard components.
Please refer to our LLM policy httpps///eaarigoccc///ooeee///es should or should not be described.
for what
35


Reviews:
[{"review_id": "TdmGadKBT9", "reviewer": "Reviewer_9cLc", "summary": "This paper introduces BitMark, a novel watermarking method for bitwise AR model. It addresses the risk of model collapse training on AI-generated content. BitMark embeds watermarks at the bit level, leveraging the observation that bitwise discrepancies in autoregressive models are smaller than token-level ones. It uses a green-red list mechanism to subtly bias bit generation, preserving image quality and generation speed while enabling reliable detection.", "questions": "Can attackers reverse-engineer the green list by analyzing large sets of generated images? If so, how does BitMark defend against such attack?", "limitations": "yes", "rating": 5, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n(1) The paper is well written and easy to follow.\n(2) The design choice is well-motivated, for example choosing bitwise watermarking rather than token-wise watermarking. Also, the green-red list mechanism adapted from LLM watermarking is cleverly adapted to image generation scenario, with modifications to handle bitwise autoregression.\n(3) The experiments are comprehensive, which shows robust performance on image quality and generation speed. Additionally, the detection process is efficient (~0.5 seconds per image), ensuring the method remains practical for real-world deployment.\n\nWeaknesses:\n(1) The method struggles with large rotation attacks. While the paper suggests that rotation estimation tools could rotate back and correct these images (, thus being easy to be detected), no experimental evidence supports this claim.", "was_revised": true, "final_justification": "Thanks authors for the reply. My concerns are addressed and I am keeping my score as accept.", "rebuttal": "We thank the Reviewer for the positive and constructive feedback. We appreciate that our work is considered *novel* and that the green-red list mechanism adapted from LLM watermarking to image generation is described as *clever*. We are glad that our *comprehensive experiments* clearly demonstrate the *practicality* of our watermark. \n\nIn summary we **implemented the rotation estimation tool** to revert rotations and observed that the detection of our watermark can be increased with the rotation correction tools. We also addressed the question regarding **reverse engineering the green list**, in essence: the choice of the arbitrary length of BitMark makes a frequency analysis (used to reverse-engineer the green list) difficult.\n\nWe address the points in detail below:\n\n>**Weaknesses: (1) The method struggles with large rotation attacks. While the paper suggests that rotation estimation tools could rotate back and correct these images (thus being easy to be detected), no experimental evidence supports this claim.**\n\nWe performed experiments to detect BitMark after correcting rotated images with the rotation estimation tool referred to in our submission [1]. Specifically, we first applied random rotations to the watermarked images from 0 to 360 degrees. We then used the rotation estimation tool [1] to estimate the rotation angles of the images and rotated them back. Our BitMark is then detected on the re-rotated images. The following table showing the detection results with and without the rotation correction was added to Appendix E.\n\n| Setting | AUC (%) | Accuracy (%) | TPR@1%FPR (%) |\n|:-:|:-:|:-:|:-:|\n| No rotation correction | 60.4 | 60.8 | 18.4 |\n| After  rotation correction | 99.5 | 99.2 | 98.3 |\n\nThe results show that BitMark achieves a significant AUC of 99.5% and a TPR of 98.3% at 1% FPR after the rotation correction. This demonstrates that the detection of our watermark can be increased with the rotation correction tools.\n\nIn addition, we consider an even harder case: after the random rotation, we apply a central crop to the image with 50% cropping ratio, such that all the black corners during rotation are completely removed. We show the results below (also added them to Appendix E)..\n\n| Setting | AUC (%) | Accuracy (%) | TPR@1%FPR (%) |\n|:-:|:-:|:-:|:-:|\n| No rotation correction | 59.8 | 58.9 | 9.9 |\n| After  rotation correction | 89.1 | 86.5 | 66.3 |\n\nEven in this harder case, the detection of our watermark is also increased after the rotation correction. Notably, our BitMark achieves a high AUC of 89.1 and a TPR of 66.3 at 1% FPR.\n\n>**Can attackers reverse-engineer the green list by analyzing large sets of generated images? If so, how does BitMark defend against such an attack?**\n\nThe attacker cannot reverse the green list since, in our watermark, we follow the Private Watermarking from KGW [13], where the generative model is kept behind a secure API. The green-list can only be reverse-engineered if the attacker could re-encode and tokenize the images. The choice of the arbitrary length of BitMark makes a frequency analysis (used to reverse-engineer the green list) difficult, as the frequency analysis has to be done for multiple possible patterns of size n. Additionally, even the knowledge about the green list is not effective in removing our watermark, which we show with our Bit-Flipper attack. The attack cannot remove our BitMark without causing a severe image degradation.\n\n---\nWe would like to thank the Reviewer again for the questions and comments. The paper has definitely improved as a result. We would like to check if there are any other questions or concerns that we can address.\n\n**References:**\n\n[1] Maji Subhadip and Smarajit Bose. \"Deep image orientation angle detection.\" 2020.\n\n[2] John Kirchenbauer et al. “A watermark for large language models.” ICML, 2023."}, {"review_id": "eAMRf8zX5M", "reviewer": "Reviewer_7q5w", "summary": "The paper introduces BitMark, a novel bitwise watermarking method for the Infinity image generation model. BitMark embeds imperceptible signals at the bit level during image generation, allowing detection of generated content while preserving image quality and speed. BitMark is the first watermarking scheme for Infinity, with some robustness and radioactivity.", "questions": "1.  Results on Infinity-8B will be beneficial for this paper's generalization ability.\n2.  The Radioactive experiment should be conducted with various watermarked ratios on training data.\n3.  What is the superiority of this work compared with previous post-hoc watermarking schemes?", "limitations": "yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths:\n+ The first watermarking scheme for Infinity.\n+ Evaluated detectable ability and robustness.\n+ Clear motivation description.\n\nWeaknesses:\n- Generalization ability among models should be further evaluated.\n- Radioactivity is not evaluated enough.\n- It would be better if compared with baselines.\n\nThe authors also successfully evaluated the effectiveness and robustness of this work on Infinity-2B.\nThe paper is well-written. Section 3.1 clearly explains the motivation of this work.\n\nHowever, this work would also benefit from some improvements.\nFirst, although this work evaluated its effectiveness on Infinity-2B and explained the reason for the absence of other models, only the Infinity-2B model is evaluated. Without generalization among different models, the real effectiveness of this work is undecided.\n\nSecond, as the main claimed strength of this work, the radioactivity is not evaluated enough. The authors' fine-tuned model on the dataset only consists of watermarked data. In practical training, we cannot assume that only watermarked images from the same model are used in fine-tuning. \nThe dataset should be evaluated, consisting of both watermarked and benign images, together with images generated from the model with different green-red settings.\n\nThird, baselines should be compared with this work to demonstrate the superiority of this work, especially post-hoc baselines, which previous works [1,2] included to compare.\n\n---\n\n[1] Gunn, Sam, Xuandong Zhao, and Dawn Song. \"An undetectable watermark for generative image models.\" The Thirteenth International Conference on Learning Representations.\n\n[2] Wang, Ziyi, et al. \"Safe-var: Safe visual autoregressive model for text-to-image generative watermarking.\" arXiv preprint arXiv:2503.11324 (2025).", "was_revised": true, "final_justification": "The rebuttal delivered far more results, which addressed most of my concerns. I would raise my ratings.", "rebuttal": "We thank the Reviewer for the positive and constructive feedback. We appreciate that the Reviewer finds our paper to be well written and clearly motivated. \n\nIn summary, we **generalized BitMark** to three additional models, **evaluated BitMark against post-processing watermarks** and extended the **radioactivity experiments**. We address the points in detail below:\n\n>**Results on Infinity-8B will be beneficial for this paper's generalization ability. Generalization ability among models should be further evaluated.**\n\nWe ran additional experiments to demonstrate that BitMark is applicable to Infinity-8B, as well as to two other bitwise models, namely BiGR [1] and Instella [2].  *BiGR* is an image generative model that harnesses binary latent codes and *Instella* is another text-to-image (T2I) Image AutoRegressive (IAR) model leveraging bitwise next-patch prediction. \n\nWe extended our experimental analysis to include the additional models and added the experiments to Appendix E. We also report the results below: \n\nWe calculated a representative p-value for 5000 watermarked images by first calculating the respective mean z-score, then standardizing this mean z-score using the mean and standard deviation derived from z-scores of 5000 MS-COCO images. $\\Delta$ denotes the image quality difference to non-watermarked generated images. FID, KID & CLIP are reported for 10000 images.\n\n| Model  | p-value of mean z-score | $\\Delta$ FID | $\\Delta$ KID | $\\Delta$ CLIP |\n|:-:|:-:|:-:|:-:|:-:|\n| Infinity 2B, $\\delta=2$ | 1.0e-594 | -2.1169 | -0.0016 | 0.1086 |\n| Infinity 8B, $\\delta=1.5$ | 1.3e-273 | 0.5299 | -0.0018 | 0.2792 |\n| BiGR 256x256, d24, $\\delta=3$ | 1.16e-23 | -3.0304 | -0.0020 | 0.0017 |\n| BiGR 512x512, d32, $\\delta=3$ | 3.37e-31 | -3.6660 | -0.0024 | 0.1329 |\n| Instella IAR, $\\delta=1.5$ | 2.27e-69 | 1.1471 | 0.0004 | -0.8361 |\n\nThe results show that we can effectively embed our BitMark into the images generated from Infinity 8B, BiGR, and Instella, without harm to the quality of output images (relatively small changes of the FID, KID, and CLIP scores). The extremely low p-values for the respective models demonstrate that we can confidently reject the $H_0$ (null hypothesis) and claim that our watermark was indeed embedded in the generated images. Thus, BitMark generalizes to multiple models and architectures.\n\n\n>**The Radioactive experiment should be conducted with various watermarked ratios on training data.**\n\nWe performed additional experiments on the radioactivity with various ratios of watermarked data. The experiments clearly show that with an increasing amount of watermarked data, the signal of BitMark becomes stronger. Even if model M2 is trained on only 10% of our watermarked data, the model M2 can already generate images with a clear bias towards our watermark distribution, resulting in a high TPR of 22.7% @ 1% FPR. \nWe note that even a slight bias is significant at the distribution level. Concretely, we apply a statistical test, namely the Mann-Whitney-U-Test, to test if the z-score distribution of M2-generated data is significantly larger than on M1 generated data. The test is significant with a  p-value of 5.6e-62 when M2 is trained on 5% watermarked data, showing that the z-score distribution of M2-generated data is greater than the and clean data z-scores.\n\n**As shown in the following table, less than 5% of watermarked data in the training set is enough to distinguish if Infinity-2B has been trained on watermarked data.**\n\n| Metric  \\ p% of watermarked data | Clean model | Finetune (0) | 1     | 5       | 10       | 25    | 50   | 100  |\n|----------------------------------|-------------|-------------|-------|---------|----------|-------|------|------|\n| TPR@1%FPR                        | 0.1%        | 0.3%        | 1%    | 2.9%    | 22.7%    | 98.3% | 100% | 100% |\n| Mann-Whitney-U-Test (p value)    | 0.999       | 0.999       | 0.999 | 5.6e-62 | 6.8e-209 | 0     | 0    | 0    |\n\n\n>**Fine-tuning models on images generated with different green-red settings**\n\nIn our setup, a model provider decides on a specific green-red setting instead of using many of them. This makes the watermark detection much easier for the model provider. \n\n>**What is the superiority of this work compared with previous post-hoc watermarking schemes?**\n\n\nWe added a comparison of BitMark ($\\delta = 2$) against three postprocessing watermarks, namely RivaGAN [3] (with message length = 32), StegaStamp [4] (with message length = 100) and TrustMark [5] (with message length = 100). We applied the postprocessing watermarks on 1000 images generated by Infinity-2B and applied the same attacks from our paper. In the following we report the TPR@1%FPR. The experiments show that BitMark is the most robust watermark for Infinity (compared to RivaGAN, StegaStamp, and TrustMark).\n\n| Watermark vs. Attack | Average robustness | None | Noise | Blur | Color | Rotate | Vertical Flip | Horizontal Flip | Crop | JPEG | VAE | CtrlRegen |\n|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|\n| RivaGAN [3] | 72.1% | 99.7% | 98.3% | 99.7% | 99.4% | 96.7%  | 0% | 0% | 99.4% | 99.7% | 98.5% | 1.6% |\n| StegaStamp [4] | 64.6% | 100%  | 100%  | 100%  | 98.7% | 32.1%  | 1%            | 33.8% | 1% | 100% | 100% | 44.2% |\n| TrustMark [5] | 55.2% | 99.9% | 99.5% | 99.9% | 2.2% | 2.7% | 0.7% | 99.8% | 1.6% | 99.9% | 99.7% | 1.1% |\n| BitMark ($\\delta = 2$) | 89.9% | 100% | 99.6% | 99.9% | 99.8% | 20.1% | 78.8% | 100% | 98.8% | 100% | 100% | 91.6% |\n\n---\nIf the above responses address some of the Reviewer's concerns, we would greatly appreciate it if they could consider updating their rating to reflect this.\n\n**References:**\n\n\n[1] Hao et al. “BiGR: Harnessing Binary Latent Codes for Image Generation and Improved Visual Representation Capabilities” ICLR 2025.\n\n[2] Wang et al. “Instella-T2I: Pushing the Limits of 1D Discrete Latent Space Image Generation”. ArXiv e-prints, June 2025\n\n[3] Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. 2019.\n\n[4] Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical photographs. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2020.\n\n[5] Tu Bui, Shruti Agarwal, and John Collomosse. Trustmark: Universal watermarking for arbitrary resolution images. ArXiv e-prints, November 2023."}, {"review_id": "thJYUpTdNr", "reviewer": "Reviewer_cNxC", "summary": "In this paper, the authors introduce BitMark, a bitwise watermark for the Infinity model. Unlike the token space, the authors find that bits are more robust when retokenizing the image. Therefore, they first randomly split all possible bit sequences into green and red lists. During sampling, the green bit sequences are biased to have higher generation probabilities. As a result, watermarked images will contain more green bit sequences than non-watermarked images. Meanwhile, the authors show that the proposed watermark is robust to various attacks and remains detectable.", "questions": "- I thought the watermark would be very vulnerable to a rotation attack since if you rotate the image, you mess up the bit sequence order. Do authors have any explanation for this? Or I might misunderstand something.\n- Related to the above, would the watermark be robust to a flipping attack, such as horizontally flipping the image?", "limitations": "Yes.", "rating": 4, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths:\n- The paper is well-written. The motivation is very strong.\n- The method is simple, and it requires minimal effort for the model owner to deploy it.\n- I really appreciate that the authors included various attacks, including one adaptive attack, in the paper.\n\nWeaknesses:\n- The contribution of this paper might be a little weak for me, as the authors simply apply the previous language model watermark to the Infinity model.\n- The authors only conduct the experiments with the Infinity model. I think the paper will be strengthened if the authors can include more models. I know there might not be other bitwise autoregressive image models, but maybe apply a similar technique to bitwise language models?\n- There is no comparison to other watermark techniques. I think the authors should at least compare to some post-hoc watermark methods.\n- I wonder if the watermark is very radioactive, is a good thing? If so, it means the watermark can be easily learned by an adversary, and they can perform spoofing attacks easily. Ideally, we might want an undetectable watermark.", "was_revised": true, "final_justification": "During rebuttal, the authors addressed most of my concerns by providing the additional experimental results. Therefore, I raised my score to 4.", "rebuttal": "We thank the Reviewer for the positive and constructive feedback. We appreciate that the Reviewer finds our paper well-written and the *motivation strong*. We are glad that our *comprehensive experiments* clearly demonstrate the *practicality* of our watermark and *robustness* to many attacks, including adaptive ones.\n\nIn summary, our **BitMark generalizes to three additional models**, we **evaluated BitMark against post-processing watermarks**, extended the **robustness evaluation**, and **addressed concerns regarding radioactivity**. We provide case-by-case responses below:\n\n>**The contribution of this paper might be a little weak for me, as the authors simply apply the previous language model watermark to the Infinity model.**\n\nRecent watermarking papers [1,2] focus on the token level, where the token overlap between generated and re-encoded images is small. This necessitates retraining of the encoder and decoder. Our key contribution is to demonstrate that operating at the lower bit level offers a great advantage. Specifically, we show that the bit-level overlap between generated and re-encoded images is significant and sufficient to enable direct bit-level watermarking, without retraining the encoder and decoder, and this allows us to provide the strongest known watermark for image autoregressive models. As stated by Reviewer 9clc: *“the green-red list mechanism adapted from LLM watermarking is **cleverly** adapted to image generation scenario, with modifications to handle bitwise autoregression.”*\n\n>**The authors only conduct the experiments with the Infinity model. I think the paper will be strengthened if the authors can include more models.**\n\nWe ran additional experiments to demonstrate that BitMark is applicable to Infinity-8B, as well as to two other bitwise models, namely BiGR [3] and Instella [4].  *BiGR* is an image generative model that harnesses binary latent codes and *Instella* is another text-to-image (T2I) Image AutoRegressive (IAR) model leveraging bitwise next-patch prediction. \n\nWe extended our experimental analysis to include the additional models and added the experiments to Appendix E. We also report the results below: \n\nWe calculated a representative p-value for 5000 watermarked images by first calculating the respective mean z-score, then standardizing this mean z-score using the mean and standard deviation derived from z-scores of 5000 MS-COCO images. $\\Delta$ denotes the image quality difference to non-watermarked generated images. FID, KID & CLIP are reported for 10000 images.\n\n| Model  | p-value of mean z-score | $\\Delta$ FID | $\\Delta$ KID | $\\Delta$ CLIP |\n|:-:|:-:|:-:|:-:|:-:|\n| Infinity 2B, $\\delta=2$ | 1.0e-594 | -2.1169 | -0.0016 | 0.1086 |\n| Infinity 8B, $\\delta=1.5$ | 1.3e-273 | 0.5299 | -0.0018 | 0.2792 |\n| BiGR 256x256, d24, $\\delta=3$ | 1.16e-23 | -3.0304 | -0.0020 | 0.0017 |\n| BiGR 512x512, d32, $\\delta=3$ | 3.37e-31 | -3.6660 | -0.0024 | 0.1329 |\n| Instella IAR, $\\delta=1.5$ | 2.27e-69 | 1.1471 | 0.0004 | -0.8361 |\n\nThe results show that we can effectively embed our BitMark into the images generated from Infinity 8B, BiGR, and Instella, without harm to the quality of output images (relatively small changes of the FID, KID, and CLIP scores). The extremely low p-values for the respective models demonstrate that we can confidently reject the $H_0$ (null hypothesis) and claim that our watermark was indeed embedded in the generated images. Thus, BitMark generalizes to multiple models and architectures.\n\n>**I know there might not be other bitwise autoregressive image models, but maybe apply a similar technique to bitwise language models?**\n\nNote that the LLMs do not suffer from the lack of token overlap, which is the case for Image AutoRegressive models (IARs). Our main observation is that the bit-wise overlap is significant in bit-wise IARs and enables us to embed the strong watermarks. Thus, bit-wise watermarking is not necessary for LLMs and the performance on the level of our BitMark can be already achieved on the token level. If the Reviewer can recommend any language models that utilize bit-wise generation, we would be happy to try our BitMark technique on them.\n\n>**There is no comparison to other watermark techniques. I think the authors should at least compare to some post-hoc watermark methods.**\n\nWe added a comparison of BitMark ($\\delta = 2$) against three postprocessing watermarks, namely RivaGAN [4] (with message length = 32), StegaStamp [5] (with message length = 100) and TrustMark [6] (with message length = 100). We applied the postprocessing watermarks on 1000 images generated by Infinity-2B and applied the same attacks from our paper. In the following we report the TPR@1%FPR. The experiments show that BitMark is the most robust watermark for Infinity (compared to RivaGAN, StegaStamp, and TrustMark).\n\n| Watermark vs. Attack | Average robustness | None | Noise | Blur | Color | Rotate | Vertical Flip | Horizontal Flip | Crop | JPEG | VAE | CtrlRegen |\n|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|\n| RivaGAN [5] | 72.1% | 99.7% | 98.3% | 99.7% | 99.4% | 96.7%  | 0% | 0% | 99.4% | 99.7% | 98.5% | 1.6% |\n| StegaStamp [6] | 64.6% | 100%  | 100%  | 100%  | 98.7% | 32.1%  | 1%            | 33.8% | 1% | 100% | 100% | 44.2% |\n| TrustMark [7] | 55.2% | 99.9% | 99.5% | 99.9% | 2.2% | 2.7% | 0.7% | 99.8% | 1.6% | 99.9% | 99.7% | 1.1% |\n| BitMark ($\\delta = 2$) | 89.9% | 100% | 99.6% | 99.9% | 99.8% | 20.1% | 78.8% | 100% | 98.8% | 100% | 100% | 91.6% |\n\n>**​​If the watermark is very radioactive, is it a good thing? If so, it means the watermark can be easily learned by an adversary, and they can perform spoofing attacks. We want an undetectable watermark**\n\nOur primary motivation is to prevent model collapse since we want to ensure that companies like OpenAI do not use their own generated data or **any derivatives of their generated data** to train their future models. This is precisely where the radioactivity property becomes essential: the images generated by a model fine-tuned or trained on generated data are also harmful to the next models. Thus, the spoofing attack is not a concern in this case. \n\n>**I thought the watermark would be very vulnerable to a rotation attack since if you rotate the image, you mess up the bit sequence order.**\n\nThe bit-sequence order in the latent space after tokenization is not directly transferable to the pixel space. While BitMark is applied in sequence order in the bit-space, due to the BSQ and Decoder, there are additional spatial transformations applied to the final model output. The important property that contributes to the robustness of BitMark is the large number of bits that are influenced during our watermark embedding. \n  \nWe performed an experiment computing the overlap between bits from: (1) the original generated image and the rotated encoded image, and (2) the encoded image and the rotated encoded image. Given that over 300k bits that are influenced by BitMark, even a small overlap of 50.14% at 20° is sufficient for the robust detection of our watermark.\n\n\n| **Rotation Degree** | 0° | 5° | 10° | 15° | 20° | 25° | 45° |\n|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|\n| **Average Bit Overlap** Between Generated and Rotated | 68.83% | 51.3%  | 50.37% | 50.22% | 50.14% | 50.09% | 50.05% |\n| **Average Bit Overlap** Between Encoded and Rotated | 100% | 51.66% | 50.46% | 50.26% | 50.18% | 50.12% | 50.06% |\n\n\n>**Related to the above, would the watermark be robust to a flipping attack, such as horizontally flipping the image?**\n\nWe added an additional attack to our robustness evaluation and also reported the TPR@1%FPR in the following Table:\n\n| | horizontal flip | vertical flip |\n|:-:|:-:|:-:|\n| TPR@1%FPR | 100% | 78.8% |\n\nWe observe that our BitMark is robust to the flipping attacks.\n\n---\nIf the above responses address some of the Reviewer's concerns, we would greatly appreciate it if they could consider updating their rating to reflect this.\n\n**References:**\n\n[1] Tong et al. “Training-Free Watermarking for Autoregressive Image Generation” https://arxiv.org/abs/2505.14673\n\n[2]  Jovanović et al. “Watermarking Autoregressive Image Generation” https://arxiv.org/abs/2506.16349\n\n[3] Hao et al. “BiGR: Harnessing Binary Latent Codes for Image Generation and Improved Visual Representation Capabilities” ICLR 2025. https://openreview.net/forum?id=1Z6PSw7OL8 \n\n[4] Wang et al. “Instella-T2I: Pushing the Limits of 1D Discrete Latent Space Image Generation” https://arxiv.org/pdf/2506.21022 \n\n[5] Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. 2019.\n\n[6] Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical photographs. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2020.\n\n[7] Tu Bui, Shruti Agarwal, and John Collomosse. Trustmark: Universal watermarking for arbitrary resolution images. ArXiv e-prints, November 2023."}, {"review_id": "AiRUbk2Wps", "reviewer": "Reviewer_NhKn", "summary": "This paper introduces BitMark, a bit-level watermarking framework designed for Infinity, a state-of-the-art bitwise autoregressive image generation model. The core idea is to embed watermarks directly in the bit-level token stream during inference, aligning with Infinity’s discrete and hierarchical generation structure. BitMark uses green and red bit sequence lists to subtly bias generation toward detectable patterns with negligible visual distortion. The watermark is detectable via statistical testing on the bit distribution of re-encoded images and does not require model retraining. Key contributions include (1) a bit-level watermarking method aligned with Infinity’s architecture, (2) robustness to common and dedicated removal attacks (like CtrlRegen and Watermark in the Sand), (3) negligible impact on generation quality and speed, and (4) strong radioactivity: fine-tuned models on BitMark outputs also inherit the watermark, making it useful for provenance tracking and preventing model collapse. Extensive experiments on MS-COCO show strong detection accuracy, minimal perceptual impact for low watermark strength, and robustness to both synthetic and adversarial attacks.", "questions": "- How well does BitMark generalize to other bitwise autoregressive models beyond Infinity? Is it easily portable, or tightly coupled to specific implementation details?\n\n- For the statistical detection test, how sensitive is the threshold to dataset shifts (e.g., web images vs. MS-COCO)? Can the test fail if the distribution of bit patterns in clean images varies? It would be good if you can provide empirical checks of FPR on domain-shifted datasets.\n\n- The paper claims radioactivity even for Stable Diffusion models trained on BitMark images. This is previously considered non-trivial, and as far as I know, previous works [1] even specifically designed loss functions to increase the learnability of the watermarks. So I really wonder why is your method radioactive in nature.\n\n[1]: Li et al. Towards Reliable Verification of Unauthorized Data Usage in Personalized Text-to-Image Diffusion Models. S&P 2025.", "limitations": "Yes.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "## Strengths:\n\n- The problem of watermarking VAR models and preventing model collapse from training on synthetic content is real and increasingly urgent. Thus the topic of this paper is important and timely.\n\n- BitMark is the first watermarking technique tailored for bitwise autoregressive image generation models like Infinity. \n\n- The watermark is shown to be robust across a large variety of attack vectors including conventional image transformations, advanced watermark-removal attacks (CtrlRegen, Watermark in the Sand), and even an adaptive bit-flipping attack crafted with white-box access.\n\n- The watermark is shown to be highly radioactive even across model families (Infinity to Stable Diffusion), which is non-trivial and potentially useful for tracing data lineage.\n\n\n## Weaknesses:\n\n– The core technique, while adapted to a new domain, is heavily inspired by token-level watermarking schemes from LLMs (e.g., KGW, Unigram Watermark). The main contribution is repackaging the method for the bit-level of a specific image generation architecture. This raises questions about whether it’s truly innovative or just porting an old idea. Besides, the proposed watermarking technique seems to be specifically tailored for the Infinity model, as shown by its technical implementation and experimental validation. How would the proposed method extend to other VAR text to image models remains unknown, which would largely restrict the impact and scope of the paper.\n\n- Despite claims of “negligible” image quality impact, Table 1 shows that at watermark strength 5 the FID degrades significantly and CLIP score drops by over 5 points. This shows that the watermark is not as negligible as claimed when pushed to be stronger.\n\n- The radioactivity seems to be a strong and non-trivial property of BitMark, and it even transfers to Diffusion-based models (SD v2.1 as in this paper). However, as the authors said, previous watermarking methods designed for diffusion models do not exhibit strong radioactivity. The author attributes this radioactivity to \" slightly changing all parts of a given generated image, including low-level and high-level features, which are then also partly adapted by M2.\", however, I believe previous watermarks like tree-ring also satisifies this property. Thus  I am not convinced by this explanation and I believe more concrete analysis should be given to provide insights into the community.", "was_revised": true, "final_justification": "The authors rebuttal have addressed most of my concerns. So I raise my score to 4. The reason for not higher score is the modest novelty (as the method can be regarded as an extention of existinng LLM watermarks to autoregressive image generative models) and the mechanism under its radioactivity is not very theoretically well-justified. However, considering that the work is one of the earliest to explore watermarks for AR models, I would still support acceptance. The authors might explore it deeper in the future.", "rebuttal": "We thank the Reviewer for the detailed analysis of our paper. We appreciate that the Reviewer finds the topic of our paper important and timely. We are also glad that our comprehensive experiments clearly demonstrate the strengths of our watermark, such as the **non-trivial property of radioactivity**. \n\nIn summary, **BitMark generalizes** to two additional models, we emphasize that BitMark has **negligible impact on the quality of generated outputs**, and we also empirically **analyzed the FPR on domain-shifted datasets**. We provide the answers in-line below:\n\n>** The core technique, while adapted to a new domain, is heavily inspired by token-level watermarking schemes from LLMs (e.g., KGW, Unigram Watermark). The main contribution is repackaging the method for the bit-level of a specific image generation architecture. This raises questions about whether it’s truly innovative or just porting an old idea. **\n\nRecent watermarking papers [1,2] focus on the token level, where the token overlap between generated and re-encoded images is small. This necessitates retraining of the encoder and decoder. Our key contribution is to demonstrate that operating at the lower level of bits offers a great advantage. Specifically, we demonstrate that the bit-level overlap between generated and re-encoded images is significant and sufficient to enable direct bit-level watermarking, without retraining the encoder and decoder. This allows us to provide the strongest known watermark for image autoregressive models and, as stated by Reviewer 9clc: *“the green-red list mechanism adapted from LLM watermarking is cleverly adapted to image generation scenario, with modifications to handle bitwise autoregression.”*\n\n>**How well does BitMark generalize to other bitwise autoregressive models beyond Infinity? Is it easily portable, or tightly coupled to specific implementation details?**\n\nWe ran additional experiments to demonstrate that BitMark is applicable to two other bitwise models, namely BiGR [3] and Instella [4].  *BiGR* is an image generative model that harnesses binary latent codes and *Instella* is another text-to-image (T2I) Image AutoRegressive (IAR) model leveraging bitwise next-patch prediction. \n\nWe extended our experimental analysis to include the additional models and added the experiments to Appendix E. We also report the results below: \n\nWe calculated a representative p-value for 5000 watermarked images by first calculating the respective mean z-score, then standardizing this mean z-score using the mean and standard deviation derived from z-scores of 5000 MS-COCO images. $\\Delta$ denotes the image quality difference to non-watermarked generated images. FID, KID & CLIP are reported for 10000 images.\n\n| Model  | p-value of mean z-score | $\\Delta$ FID | $\\Delta$ KID | $\\Delta$ CLIP |\n|:-:|:-:|:-:|:-:|:-:|\n| Infinity 2B, $\\delta=2$ | 1.0e-594 | -2.1169 | -0.0016 | 0.1086 |\n| Infinity 8B, $\\delta=1.5$ | 1.3e-273 | 0.5299 | -0.0018 | 0.2792 |\n| BiGR 256x256, d24, $\\delta=3$ | 1.16e-23 | -3.0304 | -0.0020 | 0.0017 |\n| BiGR 512x512, d32, $\\delta=3$ | 3.37e-31 | -3.6660 | -0.0024 | 0.1329 |\n| Instella IAR, $\\delta=1.5$ | 2.27e-69 | 1.1471 | 0.0004 | -0.8361 |\n\nThe results show that we can effectively embed our BitMark into the images generated from BiGR and Instella, without harm to the quality of output images (relatively small changes of the FID, KID, and CLIP scores). The extremely low p-values for the respective models demonstrate that we can confidently reject the $H_0$ (null hypothesis) and claim that our watermark was indeed embedded in the generated images. Thus, BitMark generalizes to multiple models and architectures.\n>**Despite claims of “negligible” image quality impact, Table 1 shows that at watermark strength 5 the FID degrades significantly and CLIP score drops by over 5 points. This shows that the watermark is not as negligible as claimed when pushed to be stronger.**\n\nBitMark strength of $\\delta \\le 3$ has a negligible impact on the image quality, as depicted in Table 1, while being sufficiently strong, as shown in Table 3. We agree that a $\\delta=5$ degrades the image quality significantly. Therefore, we chose to run all experiments with $\\delta=2$ which does not significantly degrade the FID or CLIP score of the model. \n\n>**For the statistical detection test, how sensitive is the threshold to dataset shifts (e.g., web images vs. MS-COCO)? Can the test fail if the distribution of bit patterns in clean images varies? It would be good if you can provide empirical checks of FPR on domain-shifted datasets.**\n\nWe show that our selected $z$ threshold is robust to the dataset shifts in Table 7 in the Appendix. \n\nWe additionally computed the FPR for different natural datasets (ImageNet-1k, LAION POP, and Infinity-2B Generated images) given the 1%FPR threshold that we also used for MS-COCO.\n\n| Dataset | FPR@1%MS-COCO-FPR (N=1000) |\n|:-:|:-:|\n| MS-COCO | 0.01 (used baseline) |\n| ImageNet-1k | 0.011 |\n| LAION POP | 0.021 |\n| Infinity-2B Generated | 0.0 |\n\nOur results show that the selected threshold is not sensitive to shifts in the natural data distribution across a variety of datasets. For every dataset we compute the FPR and find that it is around the 1% FPR of the MS-COCO dataset, showing the cross-distribution robustness of the chosen threshold.\n\n>**Can the test fail if the distribution of bit patterns in clean images varies?**\n\nThe p-values for the natural images are significantly above the threshold of 1%. Thus, we never observe false positives (we never mark a natural images as watermarked).\n\n>**The radioactivity seems to be a strong and non-trivial property of BitMark, and it even transfers to Diffusion-based models (SD v2.1 as in this paper). However, as the authors said, previous watermarking methods designed for diffusion models do not exhibit strong radioactivity. The author attributes this radioactivity to \" slightly changing all parts of a given generated image, including low-level and high-level features, which are then also partly adapted by M2.\", however, I believe previous watermarks like tree-ring also satisfies this property. Thus I am not convinced by this explanation and I believe more concrete analysis should be given to provide insights into the community.**\n\nPrevious work [5] (that we cite in our submission) demonstrated that TreeRing is not radioactive even when SD v2.1 is adapted on images generated from the same model and watermarked with TreeRing. We fully agree with the Reviewer that the radioactivity property is non-trivial. We observe that while TreeRing only influences specific frequencies (low-mid range) in the initial Gaussian noise of the generation process, our BitMark is applied throughout the full generation process and impacts all frequencies in the latent space (is applied to all the resolutions). BitMark thus influences all parts of the image: the basic color in the first scales, then coarse grained structures at intermediate scales, and high level details in the last scales. We believe that this wide range of the influence, both in terms of the sheer number of modified bits and the multi-scale application, makes the generated images radioactive. \n\n\n---\nIf the above responses address some of the Reviewer's concerns, we would greatly appreciate it if they could consider updating their rating to reflect this.\n\n**References:**\n\n[1] Tong et al. “Training-Free Watermarking for Autoregressive Image Generation”, 2025.\n\n[2]  Jovanović et al. “Watermarking Autoregressive Image Generation”, 2025.\n\n[3] Hao et al. “BiGR: Harnessing Binary Latent Codes for Image Generation and Improved Visual Representation Capabilities”, ICLR 2025. \n\n[4] Wang et al. “Instella-T2I: Pushing the Limits of 1D Discrete Latent Space Image Generation”, 2025.\n\n[5] Dubiński et al. “Are Watermarks For Diffusion Models Radioactive?”, 2025."}]

Author rebuttal:

Meta-review: This paper proposes a watermarking framework for bitwise autoregressive image generative models. It adapts the green-red list mechanism from LLM watermarking to image models and embeds a watermark at the bit level of the token stream during inference.

It is the first watermarking method tailored for bitwise AR image generation. Reviewers appreciate its clear motivation and strong robustness against many attack types. It also demonstrates radioactivity across models that enables provenance tracking. Experiments show negligible image quality impact.

Reviewers had concerns initially on its generalization ability on different models and datasets, as well as the sufficiency of experimental results on its robustness against attacks and radioactivity. Authors' rebuttal provided additional experiments and clarification that addressed most concerns. As a result, reviewers reached a consensus of acceptance.

Some remaining concerns, though not critical for acceptance, are:
- Moderate novelty as this method is an adaptation of existing LLM watermarking method to bitwise image generation
- The mechanism under its radioactivity is still not very theoretically well-justified
- Although it compares with several baselines, it lacks high-level comparison and justification of where the superiority of this work is from compared with previous post-hoc watermarking schemes
Decision: Accept (poster)