StableGuard: Towards Unified Copyright Protection and Tamper Localization in Latent Diffusion Models
Authors: Haoxin Yang
Bangzhen Liu
Xuemiao Xu
Cheng Xu
Yuyang Yu
Zikai Huang
Yi Wang
Shengfeng He
Venue: NeurIPS 2025 poster ()
Keywords: Copyright protection
tampering localization
mixture-of-experts guided forensics
latent diffusion models.
Primary area: social_and_economic_aspects_of_machine_learning

Abstract: The advancement of diffusion models has enhanced the realism of AI-generated content but also raised concerns about misuse, necessitating robust copyright protection and tampering localization. Although recent methods have made progress toward unified solutions, their reliance on post hoc processing introduces considerable application inconvenience and compromises forensic reliability. We propose StableGuard, a novel framework that seamlessly integrates a binary watermark into the diffusion generation process, ensuring copyright protection and tampering localization in Latent Diffusion Models through an end-to-end design. We develop a Multiplexing Watermark VAE (MPW-VAE) by equipping a pretrained Variational Autoencoder (VAE) with a lightweight latent residual-based adapter, enabling the generation of paired watermarked and watermark-free images. These pairs, fused via random masks, create a diverse dataset for training a tampering-agnostic forensic network. To further enhance forensic synergy, we introduce a Mixture-of-Experts Guided Forensic Network (MoE-GFN) that dynamically integrates holistic watermark patterns, local tampering traces, and frequency-domain cues for precise watermark verification and tampered region detection. The MPW-VAE and MoE-GFN are jointly optimized in a self-supervised, end-to-end manner, fostering a reciprocal training between watermark embedding and forensic accuracy. Extensive experiments demonstrate that StableGuard consistently outperforms state-of-the-art methods in image fidelity, watermark verification, and tampering localization.

StableGuard: Towards Unified Copyright Protection and Tamper Localization in Latent Diffusion Models
Haoxin Yang'
Bangzhen Liu'
Xuemiao Xu Cheng Xu
Yuyang Yu!
Zikai Huang'
Yi Wang'
Shengfeng He²
South China University of Technology Singapore Management University
Dongguan University of Techholoog
harxis@outlook. com xuemxØscut.cc
cschengxu, yyyoung0611, zikaihuang0428) @gmail..mmaa...mm.mm com
yiwangSdgut. edu. shengfenghhe@smu.ce sg
https: /etp::///ghttt..... htw.hh....o//aa.isssaaaaaaeeaeae
Abstract
The advancement of diffusion models has enhanced the realism of Al-generated content but also raised concerns about misuse, necessitating robust copyright pro- tection and tampering localization. Although recent methods have made progress toward unified solutions, their reliance on post hoc processing introduces consider- able application inconvenience and compromises forensic reliability. We propose StableGuard, a novel framework that seamlessly integrates a binary watermark into the diffusion generation process, ensuring copyright protection and tampering localization in Latent Diffusion Models through an end-to-end design. We develop a Multiplexing Watermark VAE (MPW-VAF) by equipping a pretrained Variational Autoencoder (VAE) with a lightweight latent residual- the generation of paired watermarked and watermark-fii -free images. These pairs, fused via random masks, create a diverse dataset for training a cumpering-agnosiee forensic network. To further enhance forensic synergy, introduce Mixture-of of- Experts Guided Forensic Network (MoE-GFN) that dynamically integrates holistic watermark patterss, local tampering traces, and frequency -omain cues for precise watermark verification and tampered region detection. The MPW-VA VAE and MoE- GFN jointly optimized in self-supervised. end-to-end manner, fostering reciprocal training between watermark embedding and forensic accuracy. Extensive experiments demonstrate that StableGiuard consistently outperforms state-of-the--rt methods in image fidelity, watermark verification, and tampering localization.
adapter, enabling
Introduction
The unprecedented capabilities of latent diffusion models (LDMss) have revolutionized image syn- thesis, redefining artistic creation and visual content production [16]. However, as these models become more accessible, concerns over unauthorized use and malicious content tampering have intensified, necessitating solutions to safeguard intellectual property and ensure content authenticity.
Traditional copyright protection relies on watermarking techniques [7]], which embed identifiable information into images through post-hoc processing. While effective in some cases, these methods introduce computational overhead and image degradation due to their detachment from the generative process. Recent approaches to diffusion-nanne watermarking integrate embedding mechanisms directly within the generation pipeline 10 14 but they fail to support advanced forensic needs
Corresponding authors.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Although recent works have attempted unify copyright protection and tampering localization in a single framework [21-23], they remain inherently post-hoc, with generation and forensics optimized independently. This decoupled optimization prevents mutual enhancement between the two tasks, thereby limiting both the overall forensic robustness and practical applicability. The absence of seamless framework that integrates these functionalities an LDM-native manner remains a major gap, hindering real-world deployment in security- sensiit-eensitive applications.
such as quantifying tampering severity or precisely localizing manipulations [15-20] 20
To bridge the gap between copyright protec- tion and content forensics in LDMs, we pro- pose StableGuard, a unified framework that in- tegrates holistic watermark directly into the gen- erative process. Our core insight is twofold: (i) holistically distributed watermarks exhibit inherent robustness against localized manipu- lations due to spatial redundancy, and (ii) the subtle perturbations introduced by these water- marks can serve as reliable cues for tamper- ing localization through missing feature detec- tion. These complementary properties make holistic watermarking a compelling foundation for jointly addressing ownership verification and fine-gratd tree-graiedd forensic analysis in a unified LDM-native manner. StableGuard achieves this integration through two key components: the Multiplexing Watermark Variational Au- toencoder (MPW-VAE) for embedding water- marks during generation, and the Mixture-of- Experts Guided Forensic Network (MoE-GFN) for tamper-agnoste forensic analysis. MPW- VAE extends the standard LDM architecture by incorporating trainable watermark adapter within the VAE decoder and employs a multi- plexing strategy to generate both visually in- distinguishable watermarked and watermark- free images, facilitating self-supervised training without manual annotations. MoE-GFN performs watermark extraction and tampering localization via a Mixture-of- Forensic-Experts Mflcture-o--Forrnniic----eee Extraction Expert, a Tampering Localization Expert, and Boundary Enhancement Expert. These experts are dynamically fused by a Dynamic Soft Router, allowing for precise and holistic forensic predictions. The MPW-VAE and MoE-GFN are trained jointly in end-to-end manner, enabling mutual reinforcement between watermark embedding and forensic performance. Extensive exper- iments across multiple benchmarks demonstrate that StableGuard outperforms existing methods in both watermark retrieval and tampering localization, validating its effectiveness for real-world security-sensitivy applications.
(4) Post hot Metheds
railing."
Copyright
Predi
Network
Watermal ked Image
Tampered
imge
Bit WiM
mage
Mayk
MPW-VAE
Image
(10 Our StahleGuard
T21
Original
Water marised image
cat railing.
Denaising
Bit WM.
Output
Block
MoFE
Pred. WM.
Gisting
TLE
WEE
BEE
Tempered image
Irput
Figure I: (a) Unlike other post-hoc methods that add external watermarking, introducing overhead and detaching from the generative process. (b) StableGuard embeds a holistic binary watermark directly into the diffusion pipeline and adaptively extracts intrinsic perturbation patterns via collab- orative forensic experts, enabling unified, precise, and seamless protection within LDMs.
(MoFE) block comprising three specialized experts: a Watermark
In summary, our main contributions are as follows:
We introduce StableGuard, a unified proactive forensics framework for LDMs, seamlessly integrat- ing copyright protection and tampering localization into LDM-based image generation.
We propose simple yet effective sulf-super forensic learning framework that embeds an imperceptible, holistic bit watermark via a multiplexing watermark VAE. This enables precise copyright protection and tampering localization without requiring labeled data.
We develop compering-agnostie mixture-of-experr forensic network that synergistically integrates holistic, subtle, and boundary features extract forensie cues, ensuring robust watermark retrieval and precise tampering localization across various attack scenarios.
Extensive experiments demonstrate that StableGuard outperforms state-of-the-ane methods in both forensic accuracy and robustness while preserving the visual fidelity of generated images.

---

2 Related Work
2.1
Image Watermark
Image watermarking has long served as a foundational technique for intellectual property protec- tion 24 28 Traditional approaches typically rely encoder and decoder architectures 7 [), flow-based models [21 (29]. or per-image encoding strategies 7 30]. These methods are often implemented separate steganographie modules applied after image generation, introducing addi- tional processing overhead and potential degradation in visual quality. In parallel, diffusion models, particularly latent diffusion models (LDMs), have recently achieved remarkable progress across diverse domains 2 31 35 Motivated by this success, recent studies have explored embedding watermarks directly into the generative process [ 14 36]. For example, Tree-Ring (36] modi- fies the initial noise vector, CRoSS [4] employs mage-to-imaan
steganography. and methods such as Stable Signature [0], WOUAF T and Waliff 12 fine-tune L.DMs to embed watermarks in latent space. While these LDMM-ntive approaches improve integration and visual fidelity, they gener- ally neglect tampering localization- a key aspect for assessing manipulation severity and enabling forensic content reuse. Our work introduces unified framework that jointly addresses copyright protection and tampering localization LDMs, leveraging mutual optimization between watermark and forensic analysis to deliver robust, high-fidelity image forensics.
2.2 Tampering Localization
Tampering localization aims to detect and localize manipulated regions, erucial for verifying image authenticity and quantifying alterations 21 37 (38.. Existing methods fall into two broad
categories: passive detection and proactive defense. Passive methods rely solely on visual artifacts. For instance, MVSSNet [15] captures boundary inconsistencies, IML-ViT [6 extracts multi-scale
features via transformer backbone, and PSCC-Net [17], ObjectFormer 18 and HDF-Net [19]
enhance spatial awareness using complementary cues. However, these approaches often require paired supervision and struggle to generalize across manipulation types. Proactive defenses embed auxiliary signals into the image to aid future tamper detection. Traditional fragile watermark offers block- level localization but lacks adaptability [39, Recent methods like Mal.P [44), EditGuard (21].
OmniGuard [22] and WAM [23] use learned templates or invertible flows to embed watermarks for both copyright and localization. Other approaches [45] [46] explore semi-supervised tampering localization, offering post-hoc forensic analysis without prior watermarking. Despite their advantages, these post-hoe designs require external embedding networks, introduce application complexity, and prone to quality degradation, especially for LDM- generated content. Moreover, methods like EditGuard and OmniGuard rely on reference images 21 222,
making them sensitive to auxiliary input quality. In contrast, our proposed StableGuard integrates watermark directly into the LDM process, eliminating the need for post-processing. This diffusion-native approach unifies copyright protection and tampering localization within single, end-to-end framework where both tasks reinforce one another.
3 Proposed Method
3.1 Preliminaries of Latent Diffusion Models
Latent Diffusion Models (LDMs) are a class of generative models that synthesize images by iterative denoising latent representation 115. Unlike conventional diffusion models 47 48 that operate in pixel space, LDMs first encode images into a lower-dimensional latent space, enabling more efficient training and inference while preserving image fidelity. The generative process begins by sampling latent vector 27 ~ (O,, I), which is progressively denoised through the recurrence:
1- Cr
2t-1 Vou
21
Oz co(())))
(1)
vT
where 2, is the latent at timestep t, a is the noise schedule, and ā; = II' - a.. The model ép predicts the added noise at each step. This iterative refinement continues until the clean latent zo is recovered. Finally, 2p is decoded into image space via a VAE decoder:
X VAE Decoder(2o)
(2)
3

---

Predictod Mask
EKC BOC
Drc TAL
WXL SU022
fourdd Droouer
M
VIDAE
Iminge
Mjor
frau
Cormacted Lever
Conchharwl
W
Trara
FIT
Traeslov
Fax.
Aesskulliickk
Erioeaded
(al Overall Framework
mi0110nc1
(cl Mixture of Forcasiic Experts Block
Enteedte Wa
Block)
Dynamic
Asamp
Beshape & Uissomplle
lamzering Lociliation Dpprr
Watermark Emtuctio Dpprtt
Boundary
Erhancoment
Parayta
Dpertt
Eating
Cottrn
Catter
Corn:
SjicE
OurguR
Aduptee
Sab-Pairh Partition
Budde Phone
Inpul feoturee
Figure 2: Overview of the StableGuard Framework. StableGuard integrates MPW-VAE and an MoE-GEN in a self-supervised, end-to-end pipeline. The MPW- VAE generates visually consistent wa- termarked and non-watermarked image pairs from the same latent code by introducing a lightweight, residual-based watermark adapter into the LDM decoder. These image pairs, augmented via random masking, form diverse training set for MoE-GFN training. MoE-GFN adaptively fuses features from multiple forensic experts to extract robust, unified signals from holistic watermark perturbations. Joint optimization of both components enables reciprocal enhancement of watermark embedding and forensic analysis, supporting accurate copyright verification and tampering localization.
3.2 Overview
To enable imperceptible watermark embedding and robust forensic analysis within LDMs, we propose StableGuard, a unified framework for copyright protection and tampering localization that integrates seamlessly into the LDM pipeline. As illustrated in Fig. 2 StableGuard consists of two core components: the Multiplexing Watermark VAE (MPW- VAE) and the Mixture-of-Exxerts Guided Forensic Network (MoE-GFN). MPW-VAE introduces a hierarchy of lightweight, latent residual-basee watermark adapters into the LDM's VAE decoder, enabling holistic binary watermark embedding while preserving perceptual fidelity. Crucially, watermark adapters can be toggled on or off, facilitating the generation of paired watermarked and clean samples from shared latent, supporting fully self-supervised training of the forensic module. For downstream analysis, MoE-GFN leverages the subtle perturbations introduced by the watermark to perform both extraction and tampering -oeeoooo--oo-----eeee
localization. Central to this network is the three expert branches specialized in capturing complementary forensic cues. Their outputs adaptively fused through a dynamic soft routing mechanism, allowing the network to selectively emphasize relevant features and achieve robust, accurate forensic predictions.
(MoFE) Block, comprising
3.3 Multiplexing Watermark VAE
Most existing passive tampering localization methods depend manually annotated masks for supervised learning, which not only labor-intensive but also exhibits poor generalization across diverse manipulation scenarios [15] To address these challenges. we propose the MPW-VA VAE. which incorporates a togglable lightweight watermark injection branch into a pre-trained LDM VAE decoder. This multiplexing design enables the generation of visually indistinguishable watermarked and watermark-fe image pairs from the same latent input, providing a scalable foundation for self-superviser learning forensic tasks.

---

To preserve visual fidelity, watermark embedding is achieved through latent residual -bsed adapters inserted after each block of the VAE decoder. Each adapter encodes the watermark via two fully connected layers, reshapes the embedding to match the feature dimensions, and concatenates it with the decoder features. The fused features are then processed through two convolutional blocks, followed by residual connection to the input. This design ensures coherent and unobtrusive watermark integration (see Fig. 2(b)). Leveraging this residual mechanism, MPW- MPW-VAE produces watermarked images with imperceptible yet traceable watermark signals, while maintaining high visual similarity to the watermark- free outputs generated by the original decoder.
To simulate diverse and realistic tampering scenarios, we synthesize training samples by randomly fusing watermarked images Y with their watermark- counterparts, either the VeEosecontrr image X or the original image X, using a random binary mask M:
Y (1 M) O Y + M 0.5 0.5 (1 M) O Y + MOX, p> p>0.5 0.5
(3)
where Y denotes the synthesized training image, and p controls whether the spliced region is drawn from the VAE reconstruction the original image. Specifically, we use X (a real image) simulates hude manipulations produced by editing tools (e.g., Photoshop), while using X (the vanilla LDM VAE reconstruction) emulates Al-generated forgeries increasingly common with generative models. To diversify tampering patterns, we adopt hybrid masking strategy: with 50% probability, we apply random binary masks; otherwise, we use semantic masks drawn from a pool of SAM- A-M-generated segmentations (9 These SAM-based masks are waa-immaa--peeeeee ensuring shape diversity without extra supervision. This augmentation strategy enables the network to learn to distinguish watermarked from woteraaermrrked regions in seff-supervised manner, thereby supporting robust joint learning of watermark extraction and tampering localization.
3.4 Mixture-of-Experrs Guided Forensic Network
The embedding of holistic watermarks into generated images enables not only robust watermark verification but also tampering localization by identifying disruptions in the underlying perturbation patterns. To effectively harness the synergy between these two tasks, propose the Mixture-of- Experts Guided Forensic Network (MoF-GFN). Inspired by the mixture-of-expprts paradigm (50), MoE-GEN integrates task-specialized modules to enhance forensic performance through collaborative feature modeling. As illustrated in Fig. aa. MoE-GFN adopts UNet-based architecture(511 (51) where the decoder is augmented with a Mixture-of-Foreeee Forensic-Experts (MoFE) Block (Fig. Cc). This block comprises three dedicated experts- experts-Wattrrmat Extraction, Tampering Localization, and Boundary Enhancement each designed to capture complementary forensic cues. Their outputs are fused via Dynamic Soft Router, which adaptively integrates task-relevant features based on the input. The complete pipeline includes a Stem module [52) for dimensionality reduction, a UNet backbone for multi-scale feature extraction, and a Forensic Decoder for final prediction.
Watermark Extraction Expert. To recover globally embedded watermarks even under local modi- fications, we employ a transformer-batt expert that captures long-range dependencies. By modeling global correlations, this module provides robust watermark reconstruction and indirectly facilitates tampering localization by highlighting regions where watermark patterns are missing. Given input features x E Rb,c,,,a we reshape them to Taat Rb.kw, and process them through linear projection (Proj), followed by Multi-Head Self-Attentio (MHSA) and a Feed-Forward Network (FFN) [53] The final output is computed with residual addition:
Twm (PPOOHS((P (Proj(zAm))) + T'at
(4)
Tampering Localization Expert. In contrast to watermark extraction, tampering localization de- mands sensitivity to subtle, local inconsistencies. To this end, we propose a sub-patch transformer that partitions feature maps into smaller patches and applies localized attention to enhance the detection of fine-grained manipulation artifacts. Formally, the input is partitioned into n. x n patches and reshaped to Ixub E RR.
hw n² se is then processed as:
Trmpp FFN(MHSA(Proo
+ Zsub-
Boundary Enhancement Expert. To further refine tampering boundaries, we incorporate frequency- domain cues through Boundary Enhancement Expert, which highlights freeufrryenncy components
5

---

indicative of manipulation edges. This expert applies transformer in the Fourier domain to capture Soundary-specifee anomalies that may be missed in the spatial domain. Given input z, we compute its Fourier transform, reshape the frequency representation, and process it through transformer layers before applying the inverse transform:
FTTT Reshape(FFT(r)) (b, hwn,
(6)
Thound (PP(FFFNMMISA(PPO((rTTT + ØFFT).
where FFT and iFFT denote the Fourier transform and inverse Fourier transform, respectively.
Dynamic Soft Router. To adaptively fuse the outputs of the three expert branches. we introduce Dynamic Soft Router, which predicts expert-specific fusion weights conditioned on the input. This mechanism enables MoE-GFN to dynamically modulate focus based on the type and spatial characteristics of the tampering. Given a shared input feature map the router generates soft weights R = Sfftmax(f where f(() is a lightweight multi-layer perceptron. The unified forensic representation is computed as weighted sum:
Funilied Σ R. Expert, (x).
By enabling input-adaptive feature integration, the Dynamic Soft Router enhances the model's s ability to generalize across diverse manipulation patterns, yielding more resilient forensic predictions.
3.5 Loss Function
StableGuuar is trained in fully self-supervised, end-to-end manner, enabling mutual enhancement between watermark embedding and its watermark extraction and tampering localization tasks. During MPW-VAE training, freeze the parameters of the pre-trained LDM VAE decoder and update only the watermark adapter. This strategy ensures high perceptual fidelity between the original and watermarked images while effectively encoding watermark information. The total training objective comprises three components: similarity loss to maintain image quality, a watermark loss to ensure accurate extraction, and tampering loss to localize manipulated regions precisely.
Similarity Loss. To preserve visual consistency between the watermarked image Y and the recon- structed watermark-free image X, we combine L11 distance with perceptual similarity (54):
Saim = || Y|l1 Y).
(8)
Watermark Loss. We supervise watermark extraction using binary cross-entropy loss:
Lwm - (W log(W)) + (1 Wi) log(1 - wi)).
where W and W are the ground truth and predicted watermark bits, and L is the total bit length.
Tampering Loss. To achieve precise localization of tampered regions, we combine weighted binary cross-entropy (WBCE) with Dice loss [55]:
Lramper
Co + (1 Ao Ldices
(10)
Lubce
1
Σ i.j
A1 Mi (og(o + t22 (1 -Mis) log(1 (M..)))
(11)
2 E Maj ((Mes) En, (M..)² E,,, (o(M).)))
Luice =
(12)
where and M denote the ground truth and predicted tampering masks, o is the sigmoid function, N is the total number of pixels, i, are the pixel indices, and \1 A2 weighting factors for foreground and background.
Total Loss. The final training objective for the StableGuard framework is defined as:
Listal Lsim + Lum Lrampar.
(13)

---

Promgt
Original image
StableGuard WM
EditGiurd
OmmiCuurd
WAM
StableGuard
"A dragon perched atop mountain peak."
"A colorful hot air balloon floating over mountain range."
Figure 3: Comparison between the original Stable Diffusion VAE and variant using our MPW-VAL alongside other watermarking methods [3]. To better visualization, pixel-wise differences are amplified 100x. StableGuard embeds holistic watermarks that remain visually imperceptible while preserving image quality.
4 Experiments
4.1 Settings
Datasets. We train StableGuard on the COCO training set (56) in a fully self-supervised manner, without requiring any manual tampering annotations. For evaluation, watermark extraction is tested on both the COCO test set and a custom -ikatto-mmae (T2I) dataset, measuring performance on real and LDM-generated content. To assess tampering localization, we focus robustness against Al-generated manipulations using a large-scale AIGC benchmark of 35,000 images 5,,000 from COCO and 10,000 from T2I dataset. Semantic masks generated with SAM 49 followed by region edits using Stable Diffusion (1) SDXL (2), Kandinsky [57] ControlNet and LaMa [58] Further details provided in the Appendices.
Implementation Details. StableGuard implemented in PyTorch, built upon Stable Diffusion 2. 1 During training, we freeze the base model and optimize only the Watermark Adapter and MoE-GFN using the Adam optimizer epochs two NVIDIA RTX 4090D GPUs with a batch size of 16. The tampering localization expert
(59] with a learning rate of x 10-1 All experiments are run for 10
operates on sub-patches of size n = Loss weights are set as Xg = 0.2 (Eq. (10).. A1 = 2, and A2 = 0.5 (Eq.
4.2 Comparison on Watermarking
The effectiveness of our proposed StableGuard for watermark embedding and extraction is validated by experiments on two datasets: the COCO dataset and the T2I dataset. To intuitively demonstrate StableGuard's 's watermark injection capability, from the T2I dataset and compare with three post-hoc watermarking methods (21-23) in Fig. 3 The corresponding prompts for generating images are "A dragon perched atop mountain peak and "A colorful hot air balloon floating over mountain range". respectively. As observed, the images before and after watermark embedding exhibit high visual consistency, with pixel-wise differences at negligible level. The difference maps reveal globally distributed pixels across the entire image, demonstrating that StableGuard indeed effectively embeds holistic imperceptible watermarks while maintaining high-fidelity image generation results.
showcase two watermark embedding examples
We also quantitatively compare the performance of StableGuard with eight state-of-the-art water- marking techniques under different watermark bit lengths L.). The compared methods include five
post-hoc watermarking approaches: HiDDeN (7). SepMark (8), EditGuard [21] OmniGuard [22]
and WAM (23). as well as three diffusion-
methods: Stable Signature [10], WOUAF [II],
and WaDiff [12] As shown in Tab. [ our approach maintains competitive with existing solutions
on effectively preserving the perceptual quality of the original content after watermark embedding,
where the embedded images exhibit close visual similarity with their non- watermarked counterparts.
1-base

---

Table 1: Quantitative comparison COCO results are bolded and underlined, respectively.
|56
and the T2I dataset. The best and second-best
COCO Dataset
[56
T2I-Dataset
Method
B.L.
PSNRT
SSIM
LPPPS]
FIDL
Bit Acc1
PSNRT
SSIMT
LPIPS]
FIDI
Bit Acc!
HiDDeN
32
31.95
0.879
0.104
20.0
98.80
32.03
0.881
0.101
19.9
98.79
SepMark 8
32
35.38
0.929
0.090
20.3
98.85
35.42
0.931
0.089
20.1
98.86
WOUAF 11
32
31.20
0.906
0.115
21.6
99.13
31.14
0.908
0.113
21.7
99.14
Stable Signature
10
48
30.12
0.890
0.120
20.9
99.12
30.06
0.892
0.118
20.8
99.10
WaDiff 12
48
35.55
0.960
0.085
19.8
98.14
35.49
0.962
0.083
19.6
98.13
EditGuard
21
64
32.75
0.937
1.1
20.0
99.77
32.87
0.939
0.103
19.9
99.78
OmniGuard
100
37.54
0,950
0.072
20.1
98.
37.32
0.944
0.070
20.0
98.09
WAM 23
32
38.20
0.951
0.067
98.17
37.80
0.946
0.073
19.6
98.33
32
40.50
0.970
0.062
19.5
99.97
40.53
0,972
0.060
19.4
99.98
48
40.42
0.969
0.063
19.7
99.96
40.47
0.971
0.061
19.6
99.98
64
40.40
0.968
0.065
19.8
99.95
40.44
0.970
0.063
19.7
99.96
128
40.10
0.966
0.070
19.9
99.87
40.11
0.968
0.069
19.8
99. 99.88
256
40.05
0.964
0.073
20.1
99.83
40.08
0.965
0.062
20.0
99.84
(6)
(e)
Figure 4: The visualization of tampering localization results on the AIGC tampering dataset. (a) is the original image, (b) is the watermarked image by StableGuard, (c) is the tampered image, (d)-(m) are the tampering localization results of MVSS-Net (15), IML-VIT (16). PSCC-Net [17), ObjectFormer [18], HDF-Net [19], EditGuard 21]. OmniGuard 22,. WAM 23 our StableGuard, and the ground truth, respectively. Please zoom for best view.
Meanwhile, the accuracy of the watermark extracted from these images consistently outperforms existing techniques.
Unlike conventional post-hoc approaches, our method is seamlessly integrated into the LDM genera- tion pipeline, exploiting an end-to-end model directly embed watermarks into generated images. Furthermore, compared to those diffusion-natiio watermarking methods, our tailored MPW-VAE employs a latent residual-bar based watermark adapter after the VAE decoder block, which is jointly trained with the forensics tasks, thus achieving adaptive holistic watermark injection while minimally altering the original image content.
4.3 Comparison on Tampering Localization
The quantitative results of various methods on the AIGC tampering dataset are presented Tab, As shown, existing passive localization techniques exhibit notably inferior performance when compared to StableGuard, highlighting their inability effectively detect the latest AIGC tampering methods. In contrast, StableGuard demonstrates robust detection capabilities across range of AIGC tampering techniques, validating the effectiveness of our approach. When compared to EditGuard, OmniGuard and WAM, StableGuard outperforms them most metries. This improvement is a direct result of StableGuard's design, which integrates the unique characteristies of both watermarking and tampering detection. Unlike other methods, which identify tampered regions by detecting anomalies

---

Table 2: Localization precision comparison on the AIGC tampering dataset.
SD
Impainting
0
SD XL 2
Kandinsky
[3
ControlNet [1]
LAMA [Sc]
Method
F11
AUCT
lolif
F11
AUCT
lol/
F11
AUCT
lolif
F17
AUCC
lolif
F1n
AUCT
lolit
MVSS-Net
15
0,862
0.934
0.791
0.929
0.775
0.848
0.775
0.856
0.930
0.860
0.934
0,789
IML 16
0.907
0.923
0.879
0.904
0.921
0.876
0.906
0.923
0.877
0.898
0.883
0.840
0.898
0.894
0.880
PSCC-Net 0
0.898
0.976
0.829
0.899
0.977
0.830
0.894
0.975
0.825
0.899
0.977
0.830
0.898
0.976
0.829
ObjectFormer
1
0.722
0.719
0.348
0.398
0.467
0.738
HDF-Net Net 19
0.556
0.762
0.168
0,763
0.170
0.560
0.544
0.759
0.457
0.551
0.761
0.463
0.565
0.767
0.176
EdirGrard
211
0.937
0.977
0911
0.988
0.976
0.913
0.935
0.966
0.913
0.939
0.969
0.907
0.939
0.977
0.917
OmniGrard
0.853
0.964
0.867
0.973
0.834
0.868
0.966
0.830
0.858
0.965
0.815
0.864
0.999
0.823
WAM 23
0.924
0.977
0.868
0
0.976
0.862
0.921
0.976
0.865
0.917
0.977
0.860
0.922
0.967
0.864
Ours
0.980
0,993
0.962
0
0.991
0.961
0.980
0.992
0.960
0.981
0.993
0.963
0.979
0,993
0.961
Table 3: Robustness comparison on the AIGC tampering dataset under different image degradation conditions (Bit Acc/ / F1 Score).
Method
Clean
Gaussian Noise
JPHG Compression
Poisson Noise
Q=70
Q=80
Q=90
Stable Signature
10
99.10/
9
98.23/
/
96,12/
96.73/
97.19/
97.47/
WOUAF
99.14/
98.37/
98.35/
98.41 /
95.49/
96.78/
96.99/
97.67/
MVSS-Net
/0.862
/0.849
/0.878
/0.824
70.627
/0.702
/0.773
/0.844
HDF-Ner
19
/0.595
70.188
/0.574
/0.538
10,409
10.495
/0.516
00556
EditGuard
21
99.78/ 0.938
98.91 /0.897
/
0.866
06.77/0.577
0..72
97.13/0.800
99.75 / 0.887
OmniGuard 23
0.863
97.25
0.821
96.78
0..99
96.54
0.780
0.780
95.67
0.634
96.12/00.88
97.15 / 0.885
21
98.17/0.920
97.56 0.8881
97.12/
/ 0.844
95.78/0.588
96,45 00.702
96.78 00.75
98.12
Ours
99.98 0,972
99,90 0.940
99,80/ 0.939
99.69 0,928
99.73 0.908
99.88 0.927
/0.951
99.65 / 0.994
in image-based positional watermarks, StableGuard adopts a more precise method for tampering localization.
We also compare the tampering localization maps generated by different methods, as shown in Fig. As illustrated, StableGuard consistently achieves superior tampering detection accuracy compared to other methods. This is largely attributed to the self-supervised tampering detection framework we developed, which incorporates holistic watermarks through our MPW-VAE. This framework allows the forensic model to effectively differentiate between watermarked and non-watermarked regions. Moreover, the MoE-GFN we designed plays pivotal role in extracting and fusing diverse forensic features, further enhancing the accuracy of tampering localization.
4.4 Robustness Analysis
To assess robustness against image degradations, evaluate StableGuard on the AIGC tampering dataset under Gaussian noise, JPEG compression, and Poisson noise, following the protocol of prior works [9
As shown in Tab. 3] StableGuard consistently outperforms competing methods, maintaining strong watermark extraction and tampering localization under all conditions. This robustness stems from our holistic watermark embedding strategy and the MoE-guided forensic network, which distributes watermark signals throughout the image and adaptively integrates diverse forensic cues. These results highlight StableGuard's s strong potential for practical deployment.
21 22
4.5 Ablation Study
We conduct a comprehensive ablation study to evaluate the contributions of our core components: MPW-VAE, the MoE-GFN architecture, and the joint optimization strategy.
Effectiveness MPW-VAE. To assess MPW-VAE's impact on tampering localization, we replace it with WOUAF [II. ffate-of-the-art post-hoc watermarking method. Using WOUAF, we generate watermarked images (via Eq. B) and train MoE-GFN for tampering localization. As shown in Tab 4 (w/o MPW-VAE) VAE), performance degrades substantially. This gap stems from two key advantages of MPW-VAE: 1) its diffusion-naties native, ciiiuual-based watermarking enables figh-iideiity paired image generation, which significantly benefits forensic training: and 2) joint optimization with the forensic network creates a synergistic effect, enhancing both watermark embedding and tampering detection.
Effectiveness of MoE-GFN Components. We evaluate various architectural variants of MoE- GFN. Removing the entire MOFE block (w/o MoFE) and reverting to a plain UNet leads to subpar performance due to the lack of expert-driven feature extraction. Excluding individual ex- perts- Watermark Extraction (wo WEE), Tampering Localization (w/o TLE), or Boundary Enhance- ment (w/o BEE)-cach results in notable performance drops, confirming their complementary roles

---

Table 4: Quantitative ablation study on the AIGC tampering dataset, where the f represents the structure used in this paper.
Method
FIT
AUCT
loU]
Bit Acc1
Param.
Flops
win MPW-VAF
0.811
0.796
0.774
99.13
52.02M
78.51G
w/o MoFE
0.931
0,920
0.905
38.
45.72G
0.958
48.51M
70.21G
TLE
0.952
0,940
98,90
48.51M
70.21G
w/o BEE
0.962
0.950
0.940
99.11
45.23M
62.71G
w/o DSR
0.966
0.955
0.948
98.97
51.26M
75.74G
w/n JOS
0.921
0.919
0.908
99.
52.02M
78.51G
Enc
0.974
0.970
0.960
99.79
125.51M
96.156
Enc & Dec
0.982
0.988
0.976
99.96
139.41M
104, 93G
Doe
0,980
0.992
0.961
99.98
52.02M
78.51G
in capturing global watermark signals, local manipulations, and boundary refinements, respectively. Replacing the Dynamic Soft Router(w/o DSR) with simple feature summation further degrades performance, highlighting its importance in adaptively fusing expert outputs based input-specific forensic cues. While the removal of single experts (rows 3-5 in Tab. 4 leads to only modest declines in F1, AUC, IoU, and Bit Accuracy, this stems from the model operating near a performance ceiling, where marginal contributions appear limited in isolation. Crucially, the sharp performance drop when removing the entire MoFE block (row 2) highlights that these experts complementary rather than redundant: their integration is essential for robustness and accuracy.
We also explore the placement of the MoFE block within the UNet. Placing it in the encoder (Enc) improves localization but increases computational cost and underperforms compared the decoder placement. Using MoFE in both encoder and decoder (Enc & Dec) yields marginal gains but at the expense of significantly higher complexity. Thus, placing the MoFE block the decoder (Dec) strikes the best balance between performance and efficiency.
Effectiveness of Joint Optimization Strategy. To isolate the benefit of joint self-supervised op- timization, we compare StableGuard with a variant where watermark embedding/extraation and tampering localization are trained separately. Results in Tab. (w/o JOS) show that decoupled train- ing leads to weaker localization. In contrast, our unified optimization promotes stronger interaction between the embedding and forensic tasks, yielding consistent watermarks that enhance localization precision.
Conclusion
In this paper, we introduce StableGuard, a unified framework for copyright protection and tam- pering localization in the context of LDMs. By injecting a global watermark during the diffusion process and leveraging its intrinsic perturbation patterns. StableGuard achieves reliable and robust watermark extraction and tampering localization simultaneously. At the core of our method is the Multiplexing Watermark VAE (MPW-VAE), which generates visually consistent paired water- marked and watermark free images to facilitate self-supervised training of the Mixture-of -fxpurreof-Experts Guided Forensic Network (MoE-GF) GFN). This network is composed of specialized experts that handle holistic watermark analysis, subtle artifact recognition, and boundary transition detection, with the Mixture-of- Forensic-Experts (MoFE) block ensuring precise and efficient forensic analysis. Ex- tensive experimental evaluations validate StableGuard's superior performance, demonstrating its effectiveness and adaptability across a wide range of image scenarios, and highlighting its potential to advance both watermarking and tamper localization in diffusion models.
A Acknowledgement. This research is supported by the "Leading Talent" under Guangdong Special Support Program (2044XX8X0488. China National Key R&D Program (2024 (004779B4))200),, Key- Area Research and Development Program of Guangzhou City (N.22023B0100022) Guangdong Provincial Natural Science Foundation for Outstanding Youth Team Project (No. 0024B15150400100 NSFC Key Project (No. U23A20391), Guangdong Basic and Applied Basic Research Founda- tion (No. 2023B 155B151512225 150558,, Guangdong Natural Science Funds for Distinguished Young Schol- ars (Grant 2023B15 150000977, the GuangDong Basic and Applied Basic Research Foundation (2025A 1510110124, the National Research Foundation Singapore under the AI Singapore Pro- and the Lee Kong Chian Fellowships.
gramme (AISG Award No: AIS24--CC-205-0018--C
10

---

References
[1] Rombach, R.. A. Blattmann, D. Lorenz, al. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684-10695. 2022.
[2] Podell, Z. English, K. Lacey, et Sdxl: Improving latent diffusion models for high-resolution image synthesis. arXiv preprint arXiv:2307.01990 2023.
[3] Huang, Y. Huang, Liu, et al. Diffusion model-based image editing: A survey. arXiv preprint 240.:2222..555.. 2024.
[4] Zhang, I.., A. Rao, M. Agrawala. Adding conditional control to text-to-image diffusion models. In Proceedings of the IEEF/CVF International Conference on Computer Vision, pages 3836-3847. 2023.
[5] Yu, Y. B. Liu, C. Zheng, et al. Beyond textual constraints: Learning novel diffusion conditions with fewer examples. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognition, pages 7109-7118 19997118.21 2024.
[6] Ren, J., W. Li, Z. Wang, et al. Turbo2k: Towards ultra-efficient and high-quality 2k video synthesis. In Proceedings of the IEEE/CVF International Conference Computer Vision. 2025,
[7] Zhu, J., R. Kaplan, J. Johnson, et al. Hidden: Hiding data with deep networks. In ECCV, pages 682-697. 2018.
[8] Wu, X., X. Liao, B. Ou. Sepmark: Deep separable watermarking for unified source tracing and deepfake detection. In Proceedings of the 31st ACM International Conference on Multimedia, pages 1 1190-1201. 2023.
[9] Tang, W., B. Li. Tan, al. Con-based adversarial embedding for image steganography. IEEE Transactions on Information Forensics and Security, 14(8):2074-0887. 2019.
[10] Fernandez, P., G. Couairon, H. Jégou, al. The stable signature: Rooting watermarks in latent diffusion models. Proceedings of the IEEF/CVF International Conference on Computer Vision, pages 22466- 22477. 2023.
[11] Kim, C., K. Min, M. Patel, et al. Wouaf: Weight modulation for user attribution and fingerprinting in text-to-image diffussin models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 8974-8983, 2024.
[12] Min, R., S. Li, H. Chen, et al. A watermark-condrtioned diffusion model for ip protection. In European Conference on Computer Vision, pages 104-120. Springer, 2024.
[13] Wen, Y., J. Kirchenbauer, J. Geiping, et al. Tree-ring watermarks: Fingerprints for diffusion images that invisible and robust. arXiv preprint 2xXiv23355220033 2023.
[14] Yu, J.. X. Zhang, Y. Xu, et al. Cross: Diffusion model makes controllable, robust and secure image steganography. Advances in Neural Information Processing Systems, 36, 2024.
[15] Dong, C., X. Chen, R. Hu, et al. Mvss-net: Multi-view multi-scale supervised networks for image manipulation detection. IEEE Transactions Pattern Analysis and Machine Intelligence, 45(3):3539- 3553, 2022.
[16] Ma. X., Du, X. Liu, et al. Iml-vit: Image manipulation localization by vision transformet. arXiv preprint arXiv:2307. 14863, 2023.
[17] Liu, X., Y. Liu, J. Chen, al. Pscc-net: Progressive spatio-channel correlation network for image manipulation detection and localization. IEFE Transactions on Circuits and Systems for Video Technology, 32(11):505-7511, 2022.
[18] Wang, J., Z. Wu, J. Chen, et al. Objectformer for image manipulation detection and localization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2364-2373. 2022.
[19] Han, R., X. Wang, N. Bai, et al. Hdf-net: Capturing homogeny difference features to localize the tampered image. IEEE Transactions on Partern Analysis and Machine Intelligence, 2024.
[20] Zhuang, P. H. Li, S. Tan, et al. Image tampering localization using a dense fully convolutional network. IEEE Transactions Information Forensies and Security. 11.2986-2999 2021.
11

---

[21] Zhang, X., R. Li, J. Yu, et al. Editguard: Versatile image watermarking for tamper localization and copyright protection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 11964-11974 2024.
[22] Zhang, X., Z. Tang, Z. Xu, et al. Omniguard: Hybrid manipulation localization via augmented versatile deep image watermarking. arXiv preprint arXiv:4412006615 2024.
[23] Sander, T., P. Fernandez, A. O. Durmus, al. Watermark anything with localized messages. In The Thirteenth International Conference on Learning Representations. 2025.
[24] Li, Y., H. Wang. M. Barni. A survey of deep neural network watermarking techniques. Neurocomputing, 461:171-199 193, 2021.
[25] 7hang, J. D. Chen, J. Liao, et al. Deep model intellectual property protection via deep watermarking. IEEE Transactions on Puttern Analysis and Machine Intelligence, 44(8):4005 2021.
[26] Yan, F. H. Huang. X. Yu. A multiwatermarking scheme for verifying medical image integrity and authenticity in the internet of medical things. IEEE Transactions on Industrial Informatics, 18(12)8885- 8894, 2022.
[27] Wu, H., G. Liu, Y. Yao, et al. Watermarking neural networks with watermarked images. IEEE Transactions Circuits and Systems for Video Technology, 31(7):251-22011 2020.
[28] Yang, H., X. Xu, C. Xu, et al. G2face: High-fidelity reversible face anonymization via generative and geometric priors. IEEE Transactions on Information Forensics and Security, 2024.
[29] Fang, H., Qiu, K. Chen, et al. Flow-hased robust watermarking with invertible noise layer for black-box distortions. In Proceedings of the AAAI conference on artificial intelligence, 4, pages 5054-5061. 2023.
[30] Fernandez. P., A. Sablayrolles, Furon, et al. Watermarking images in self-supervised latent spaces. In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 3054 3058, IEEE, 2022.
[31] Liu, B., Y. Yu, X. Xu, et al. Genpoly: Learning generalized and tessellated shape priors via 3d polymorphic evolving. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025.
[32] Huang, Z., X. Xu, C. Xu, et al. Beat-it: Beat-synchronized multi-condition 3d dance generation. In European conference on computer vision, pages 273-290. Springer. 2024.
[33] Yang, Y. Z. Huang, C. Xu, et al. Lagrangian motion fields for long-term motion generation. arXiv preprint arXiv:2409.01523 2024.
[34] Huang, Z., Y. Zhou, X. Xu, et al. Think2sing: Orchestrating structured motion subtities for singing-driven 3d head animation, arXiv preprint arXiv:2509.008 02278, 2025.
[35] Yang, H., W. Chen, X. Xu, al. Starpose: 3d human pose estimation via spatial-tempont autoregressive diffusion, IEEE Transactions on Circuits and Systems for Video Technology. 2025.
[36] Wen, Y., J. Kirchenbauer, J. Geiping, et al. Tree-rings watermarks: Invisible fingerprints for diffusion images. Advances in Neural Information Processing Systems, 36, 2024.
[37] Zhuang, P.. H. Li, R. Yang, et al. Reloc: A restoration-asiitedd framework for robust image tampering localization. IEEE Transactions on Information Forensicy and Security, 2023.
[38] Peng, R., S. Tan, X. Mo, et al. Employing reinforcement learning to construct a decision makiing environment for image forgery localization. IEFE Transactions on Information Forensics and Security, 2024.
[39] Cheng, B., R. Ni, Zhao. A refining localization watermarking for image tamper detection and recovery. In 2012 IEEE 11th International Conference on Signal Processing, vol. 2. pages 984 988. IEEE, 2012.
[40] Hurrah, N. N., S. Parah, N. A. Loan, et al. Dual watermarking framework for privacy protection and content authentication of multimedia. Future generation computer Systems, 94:654-6777 2019.
[41] Kamili, A., N. N. Hurrah, S. A. Parah, et al. Dwfcat: Dual watermarking framework for industrial image authentication and tamper localization. IEEE Transactions on Industrial Informatics, (7(7):108-55)) 2020.
[42] Asnani, V. X. Yin. T. Hassner, et al. Proactive image manipulation detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2022.
12

---

[43] Asnani, V., A. Kumar, S. You, et al. Probed: Proactive object detection wrapper. Advances in Neurul Information Processing Systems, 36:77993-78005, 2023.
[44] Asnani, V., X. Yin, T. Hassner, al. Malp: Manipulation localization using proactive scheme. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12343- 12352. 2023.
[45] Zhai, Y., Luan, D. Doermann, et al. Towards generic image manipulation detection with weakly- supervised self-consistency learning. Proceedings of IEEE/CVF International Conference on Computer Vision, pages 22390 2240000 2023.
[46] Zhang, Z., M. Li, Li, et al. Image manipulation detection with implicit neural representation and limited supervision. In European Conference on Computer Vision, pages 255-273. Springer, 2024.
[47] Ho, J., A. Jain, P. Abbeel. Denoising diffusion prohabilistic models. Advances in neural information processing systems, 33:6840-688 1851,, 2020.
[48] Song, J., C. Meng. S. Ermon. Denoising diffusion implicit models. In International Conference on Learning Representations. 2021.
[49] Kirillov, A., E. Mintun, N. Ravi, et al. Segment anything. Proceedings of the IEEF/CVF International Conference on Computer Vision, pages 4015-4026. 2023.
[50] Jacobs, A., Jordan, S. Nowlan, et al. Adaptive mixtures of local experts. Neural computation, 3(1):79-87, 1991.
[51] Ronneherger, O., Fischer, T. Brox. U-net: Convolutional networks for biomedical image segmentation. In Medical image computing and computer-asiited IntrventionnMICCAA 2015: 18th international conference, Munich, Germany, October 5-9, 2015, proceedings, part III 18, pages 234-241. Springer, 2015.
[52] Zhao, Y., W. Lv,, S. Xu, et al. Detrs heat yolos real-time object detection. In Proceedings of the IEEE/CVF Conference Computer Vision and Puttern Recognition, pages 16965-16974. 2024.
[53] Vaswani, A. Attention is all you need. Advances in Neural Information Processing Systems, 2017.
[54] Zhang, R., P. Isola, A. A. Efros, et al. The unreasonable effectiveness of deep features as perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 586-595. 2018.
[55] Milletari, F. N. Navab, S.-A. Ahmadi, V-net: Fully convolutional neural networks for volumetric medical image segmentation. In 2016 fourh international conference on 3D vision (3DV), pages 565-571. Lece, 2016.
[56] Lin, T.-Y., M. Maire, Belongic, et al. Microsoft coco: Common objects in context. In Computer Vision-ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pages 740-755. Springer, 2014.
[57] Razzhigaev, A., A. Shakhmatov, A. Maltseva, et al. Kandinsky: an improved text-to-image synthesis with image prior and latent diffusion. arXiv preprint arXiv:2310.03502, 2023.
[58] Suvorov, R., E. Logacheva, A. Mashikhin, al. Resolution-rohut large mask inpainting with fourier convolutions. In Proceedings of the IEEF/CVF winter conference on applications of computer vision, pages 2149-2159. 2022.
[59] Kingma, D. P., J. Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 2014.
[60] Wang, Z., A. C. Bovik, H. R. Sheikh, et al. Image quality assessment: from error visibility to structural similarity. IEFE transactions on image processing, 13(4):600661,, 2004
[61] Heusel, M., H. Ramsauer, T. Unterthiner, et al. Gans trained by a two time-seale update rule converge to a local nash equilibrium. Advances in neural information processing systems, 30, 2017.
[62] Dong, J., W. Wang, T. Tan. Casia image tampering detection evaluation database. In 2013 IEEE China summit and international conference on signal and information processing, pages 422-426. IEEE, 2013.
[63] Guan, H. M. Kozak, E. Robertson, et al. Míc datasets: Large-scale benchmark datasets for media forensic challenge evaluation. In IEEE Winter Applications of Computer Vision Workshops (WACVW), pages 63-72. JEEE, 2019.
IEEE
13

---

[64] Hsu, Y.-F,, S.-F. Chang. Detecting image splicing using geometty invariants and camera characteristics consistency. In 2006 IEEE International Conference Multimedia and Expo, pages 549-552. IEEE, 2006.
[65] Wen, B., Y. Zhu, R. Subramanian, et al. Coverage novel database for copy-move forgery detection. In 2016 IEEE international conference on image processing (ICIP), pages 161-165. IEEE, 2016.
[66] Guillaro, F,, D. Cozzolino, A. Sud, al. Trufor: Leveraging all-round clues for trustworthy image forgery detection and localization. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 20606-20615. 2023.
[67] Zhou, J. Ma, Du, et al. Pre-training- free image manipulation localization through non-mutually exclusive contrastive learning. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 22346-22332 22356.. 2023.
[68] Novozamsky, A., B. Mahdian, Saic. Imd2020: A large-scale annotated dataset tailored for detecting manipulated images. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision Workshops, pages 71-80. 2020.
[69] Wu, Y., W. AbdAlmageed, P. Natarajan. Mantra-net: Manipulation tracing network for detection and localization of image forgeries with anomalous features. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pages 9543 9552. 2019.
[70] Hu, X., Z. Zhang, Z. Jiang, et al. Span: Spatial pyramid attention network for image manipulation localization. Computer Vision Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23 28, 2020, Proceedings, Part XXI 16, pages 312-328. Springer, 2020.
[71] Kwon, M.-... S.HH Nam, I.J. Yu, et Learning jpeg compression artifacts for image manipulation detection and localization. International Journal of Computer Vision, 18755)11875-1885, 2022.
14

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
The abstract and introduction clearly state the contributions made in the paper.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results
be expected to generalize other settings.
is fine to include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
The limitations are discussed in the appendix.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low images are taken in low lighting. Or speech-to-text system might be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
15

---

Justification:
This paper does not include theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yss]
Justification:
The paper describes the reproduction details and the code is available.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm.
(b) the contribution is primarily a new model architecture, the paper should describe the architccture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reprodueibility. the case of closed-source models, may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
16

---

Answer:
[Yes]
Justification:
The code is available at
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.cm
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
/
http:///....cciideo//deeeeeaaaaa CoodeSubeeiieeeeeeeeee ssi asionnolle onnolicy)))) for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: The paper presents detailed experimental details.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [No]
Justification:
The paper does not report the statistical significance of the experiments.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, at least for the experiments that support main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
should be clear whether the error bar is the standard deviation the standard error of the mean.
17

---

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of enrors is not verified.
For asymmetric distributions, the authors should be careful figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
show in tables or
error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
The paper introduces the hardware platform and training duration of the experiment.
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics http:///eerrrap..cp/bbc//tttttie
Answer: [Yes]
Justification:
The paper complies with the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [NA]
Justification: The paper does not involve potential positive socictal impacts and negative societal impacts.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no socictal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
18

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility MI..
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
The paper poses no such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Lieenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification:
The paper has appropriate citations to the models and data sources used.
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name the license (c.g.. CC-BY 4.0) should be included for each asset. For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
19

---

If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
The paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/mmoel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question:
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
20

---

Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that if the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, or originality the research, declaration is not required.
Answer: [NA]
Justification: The core method development in this research does not involve LLMs any important, original, or non-standard components.
Guidelines:
The answer NA means that the method development in this research does involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy for what should or should be described.
21

---

Appendix
A
Problem Definition
Our goal is to imprint an imperceptible holistic watermark W during the generation process of latent diffusion model for an image X, and comprehensively leverage the intrinsic patterns of this watermark to achieve reliable and robust copyright protection and tampering localization within unified framework. Let the LDMs follow generative process parameterized by Gg. The watermark embedding task can then be formulated as:
= W).
(14)
where Go represents the LDM-based image generation function, and is the latent input. The embedded watermark W remains imperceptible yet robust against various tampering manipulations T, such copy-paste splicing.
To detect tampering and recover the watermark, we employ forensic network Fe. which takes the potentially manipulated image TXX as input and simultancously produces the extracted watermark W and a tampering localization map M:
W. . = Fx
(15)
Here, Wi is expected to be reliably recovered with its integrity preserved, while M precisely identifies the manipulated regions, ensuring robust and effective framework for both watermark extraction and tampering detection.
B Comparison of Existing Methods
In this section, we provide concise overview of the key comparison methods, summarized in Tab. As illustrated, this work focuses two primary tasks: tampering localization and copyright protection for content generated by diffusion models. The compared copyright protection approaches encompass both traditional post-hoc image watermarking techniques and more recent diffusion-native watermarking methods that integrate directly with the generative process. Tampering detection methods are categorized into passive localization and proactive protection strategies. Our proposed approach offers a unified, diffusion- native solution for both tampering detection and copyright protection, achieving state-of-the of-thh-arttttt performance across both tasks.
Table 5: Comparative analysis of existing methods for copyright protection and tampering localization.
Copyright Protection
Tampering Localization
Joint Optimization
Watermarking
Method
Reference
Type
HiDDeN 7
ECCV'18
Post-hoc
SepMark 3
MM'23
Post-hoc
Stable Signature
10
ICCV'23
Diffusion-native
WOUAF 11
CVPR'24
Dillusion-native
WaDifl' [2]
ECCV'24
Diffusion-native
MVSS-Net 15
TPAMI'22
IML-ViT
arXiv'23
PSCC-Net 17
TCSVT'22
ObjectFormer
18
CVPR 22
HDF-Nel 19
TPAMI'24
EditGuard 21
CVPR'2 24
Post-hoc
OmniGuard
22
CVPR'25 25
Post-hoc
WAM 28
ICLR 25
Post-hoc
StableGuard (Ours)
NeurlPS'2. 25
Diffusion-native
C In-depth Analysis of Mixture-of-Experts Guided Forensic Network
In this paper, we introduce Mixture-of- -xppertss Guided Forensic Network (MoE-GFN), which trains specialized expert modules to address distinct forensic sub-tasks, thereby enhancing the overall forensic performance. At the core of MoE-GFN is the Cotiurr-oo--Foresi---eee (MoFE) block.
22

---

comprising three Nomain-speecii experts and dynamic soft router. As illustrated in Fig. S we visualize the feature activations of each expert alongside the weight distributions produced by the dynamic router. The watermark extraction expert exhibits strong activation in untampered regions rich in watermark signals (Twm), effectively recovering the embedded global watermark and demonstrating robustness to local tampering. The tampering localization expert focuses on corrupted regions (Niump) identifying missing watermark areas and enabling precise localization of tampering. The boundary enhancement expert targets the edges of tampered regions (Thound), extracting fine-grained features to refine boundary detection. Unlike static fusion strategies, the dynamic router assigns adaptive weights to each expert's features based on imput characteristics (Rwm: Ramp: Reound); facilitating more effective integration forensic cues and significantly improving both watermark extraction and tampering localization accuracy (Funified). In the Ablation Study section in the main text, also analyzed in detail the role of each expert and dynamic fusion strategy of MoFE and the final impact the quantization results.
Original
Rtamp
(d) Stooud
(e) Zusited
Tamper
(g)
Rump
Rooudd
GT
Figure 5: The visualizations soft weights. The Watermark Extraction Expert captures global watermark patterns, the Tampering Localization Expert focuses on fine grained artifacts, and the Boundary Enhancement Expert sharpens tampering boundaries. These complementary features adaptively fused via dynamic weighting, enabling comprehensive and precise forensic analysis.
distinct features extracted by each expert and their corresponding
D Training Process of StableGuard
The entire process fully self-supervised and trained in end-to-end manner, without requiring any manually annotated data. Both the embedding of diffusion-native watermarks and the training the joint model for watermark and tampering forensics are accomplished within unified framework.
We present the detailed training procedure of StableGuard in Algorithm [
Algorithm 1 Training Process of StableGuard.
Input: Input image X, iteration steps sleps, LDM VAE encoder E,,, LDM VAE decoder Dy, Output: MPW-VAE decoder Dr,, MoE-GFN F
1: for = to sleps do
2: Inverse latent (X).
3: Decode watermark free image X (2).).
4: Decode watermarked image Y = (2))).
5: Generate random tamper mask M.
6:
Generate tamper image Y by Eq. (3)
7:
Predict watermark and tamper area W. M (P)
8: Comptue loss by Eq. (13)
9:
Update Do and Fv.
10:
end for
23

---

E More Implementation Details and Experiments
E.1
More Implementation Details
In our experiments, we utilized two datasets: one consisting of real images from COCO (56, and the other comprising generated images from a Text-to-Imag dataset. For the real image dataset, we first reconstructed each image using our MPW-VAE and then embedded holistic watermark into the reconstructed image. For the generated dataset, we began by obtaining the denoised latent representation through stable diffusion, which then decoded into the image space using the MPW-VAE decoder to produce the watermarked image.
Texf-to-Iman (T21) Dataset. The T2I dataset is designed to evaluate the watermarking effectiveness of StableGuard in the LDM framework. To construct this dataset, we first generate the latent embedding of each image using the original pre-traied Stable Diffusion [ denoising UNet, condition on its corresponding textual prompt. We then decode this embedding through our MPW-VA VAE, producing set of watermarked images. Specifically, we leverage ChatGPT to generate 1,000 textual prompts, with each prompt yielding 10 images, resulting in a dataset of 10,000 images.
AIGC Tampering Dataset 5 The AIGC tampering dataset is collected to benchmark the performance of various tampering localization techniques against manipulations introduced by state-of- ofate-of-the-art image editing methods [224] [58]. This large-scale dataset consists of 35,000 images, comprising 25,000 from COCO and 10,000 from our T2I dataset. We utilize the Segment Anything Model (SAM) 49 to generate semantic masks by segmenting images, after which we apply Stable Diffusion Inpainting D. Stable Diffusion XI. (2). Kandinsky Inpainting [57), ControlNet [4. and LAAA (58) to edit the segmented regions. During the tampering process, we applied modifications to selected regions and composited the altered content onto the watermarked image using a corresponding binary
mask following by [2122] 22].
Metries. We leverage several widely-used metrics to collaboratively evaluate the pixel-level fidelity and perceptual quality of the generated images, including Peak Segallto-Noiise Ratio (PSNR), Struc- tural Similarity Index Measure (SSIM) 660. Learned Perceptual Image Patch Similarity (LPIPS) (54). and Fréchet Inception Distance (FID) 61 To quantify the performance of watermark extraction, we adopt the Bit Accuracy metric to calculate the proportion of correctly extracted watermark bits over the total embedded bits. For tampering detection, we used the F1 Score, the Area Under Curve (AUC), and IoU metrics to assess the accuracy and completeness of the detected area. The Score is the harmonic mean of detection precision and recall, and AUC represents the area under the ROC Curve. IoU is calculated by the intersection over the union between the detected tampered areas and the ground-truth regions.
Forensic Decoder. The forensic decoder consists of two parallel decoding heads: 1) The mask prediction head is responsible for localizing tampered regions and is implemented as a lightweight two-layer convolutional network. 2) The watermark prediction head is used for recovering the embedded watermark and comprises a two-layer convolutional network followed by fully connected layer. This modular design allows the network to jointly optimize for both localization and watermark reconstruction.
E.2 Tampering Localization Results Traditional Tampering Dataset
Our proposed StableGuard framework can be naturally extended to conventional natural images through reconstruction using variational autoencoder, demonstrating strong generalization across a wide range of image domains. To assess its effectiveness beyond synthetic settings, we con- ducted comprehensive evaluations on five widely used tampering datasets: CASIA (62,, NIST [3), Columbia [64], and Coverage [65]. The corresponding quantitative results and visual comparisons
reported in Tab. and Fig. 6
Although existing passive tampering localization methods are trained on meticulously constructed paired datasets, they consistently fall short when compared to our StableGuard and its predecessor EditGuard, OmniGuard and WAM. This performance gap reveals the inherent limitations of passive, post-hoc approaches, which often lack robustness when faced with novel manipulations or diverse
Phtts://chat... www.ttoppnniccci..
The full dataset is available at https:/gghhh..ccom///nrsssaaaaat
24

---

(a)
(4)
(e)
(h)
(1)
(8)
(m)
Figure 6: The visualization comparison of tampering localization results on the traditional tampering dataset. (a) the tampered image, (b)-(m) are tampering localization results of MVSS-Net [5
PSCC-Net [77. ObjectFormer [8] TruFor [66]. NCL-IMI. 667. IML-VIT [16], HDF-Net [9]
EditGuard OmniGuard 22 WAM 23 our StableGuurd, and the ground truth, respectively.
Table 6: Localization precision comparison with other competitive methods on five common
datasets 65 68
CAISALD [2]
NIST16 63
Columbia [6]]
Coverage [3
IMD20 (68
Mothod
Fit
AUCT
IoU!
F11
AUCT
loUl
F11
AUC1
[oU]
F11
AUCT
IoUl
F11
AUCT
IaUl
Mantra-Ne
SPAN 70
0.252
0.676
0.144
0.205
0.600
0.114
0.465
0.741
0.305
0.258
0.659
0.148
0.217
0.701
0.134
CAT-Net 71
0,258
0.717
0.184
0.695
0.948
0.573
0.418
0.460
0.264
0.292
0.739
0.194
0.184
0.452
0.102
MVSS-Nes
15
0.263
0.638
0.207
0.833
0.982
0.756
0.424
0.764
0.276
0.229
0.816
0.152
0.318
0.703
0.234
PSCC-Net
1p
ObjectFurmer
18
0,208
0.739
0.135
0.720
0.958
0.642
0.529
0.765
0.374
0,277
0.756
0.165
0.251
0.802
0,166
Tuffor [6
0.445
0.844
0.286
0.360
0.506
0.220
0.566
0.869
0.395
0.119
0.837
0.063
0.217
0,810
0.122
NCL-IML
67
0.169
0.766
0.123
0.835
0.981
0.834
0.120
0.712
0.253
0.262
0.524
0.172
0.339
0.827
0.245
19
EditGuard
21
0.914
0.951
0.365
0.921
0.957
0.831
0.953
0.951
0.933
0.915
0.961
0.928
0.906
0.926
0,851
OmniGuard
22
0.878
0.942
03812
0.910
0.953
0.857
D.941
0.9%0
0.918
0.920
0.958
0.895
0.770
0.912
0.001
WAM
0.872
0.930
0.803
0.908
0.950
0.854
0.938
0.947
0.912
0.918
0.955
0.891
0.865
0.908
0.792
Table 7: Statistics of runtime latency and VRAM on the AIGC tampering dataset.
Metric
Vanilla VAE
MPW-VAE
MoE-GFN
Lateney
12.69 ms
14.99 2033.97 MB
91.88
VRAM
1681.93 MB
428.32 MB
image distributions. In contrast, our findings underscore the advantages of proactive forensic methods, particularly those grounded watermarking strategics that are embedded during the generative process. These methods exhibit greater resilience and accuracy in both tampering detection and localization.
In addition, StableGuard demonstrates superior performance over other methods across variety of practical scenarios. It achieves this improvement while eliminating the need for complex and often restrictive post-processing procedures. This enhancement is largely attributed to the Mixture of Experts Guided Forensic Network, which designed to extract and integrate diverse forensic cues. By employing specialized expert modules and adaptive feature routing, the network enables StableGuard to jointly perform watermark recovery and tampering localization in coherent and dependable manner.
25

---

Table 8: Comparison of watermark extraction accuracy (1) under different tampering rates on the AIGC tampering dataset.
Method
10%
30%
50%
70%
90%
EditGuard 21
99.78
99.60
97.66
90.95
69.13
OmniCuard
22
98.11
98.02
96.84
91.33
83.90
WAM 23
98.17
97.11
94.89
93.74
88.53
Ours
99.98
99.98
99.96
99.27
89.58
Table 9: Comparison of false positive rate (FPR 1) the AIGC tampering dataset.
Type
EditGuard 21
OmniGuard
22
WAM 23
Ours
Partially tampered
0.0422 0.0028
0.0191 0.0024
0.0045
0.0023
Fully untampered
0.0019
0,0016
E.3 Time Complexity Analysis
We conducted additional experiments to evaluate the inference latency and memory footprint of our framework. The detailed results are summarized Tab. Specifically, we measured the runtime and memory usage of our MPW-VAE in comparison to the baseline Stable Diffusion VAE (at resolution of 512 x 512), as well as the runtime of the MoE-GFN forensic network under identical settings. The results show that MPW-VAE introduces only negligible computational overhead relative to the original diffusion VAE. Moreover, the MoE-GEN model achieves competitive runtime efficiency, with both inference latency and memory consumption well within the bounds required for practical deployment.
E.4 Forensic Accuracy under Varying Tampering Ratios
We further analyze watermark extraction accuracy under different levels of tampering, ranging from 10% to 90%. The results in Tab. [ demonstrate that our method consistently outperforms existing approaches across all tampering ratios. This robustness stems from three main factors: 1) The MPW- VAE effectively encodes holistic watermark features at multiple scales during decoding, enhancing the resilience of watermark embedding. 2) The global self-attention mechanism in our watermark extraction expert captures long-range dependencies and contextual cues that remain intact even when large regions are tampered. 3) The use of randomly generated masks with varying coverage during training, including large-area tampering, encourages the model to generalize across diverse manipulation ratios and ensures reliable watermark extraction even under severe distortions.
E.5 True Positive Rate (TPR) under Tampering Scenarios
Our framework is designed proactive watermarking system 231 where the watermark plays a central role in simultancously enabling copyright protection and tampering localization. Unlike passive detection methods, we assume that images watermarked at creation time; thus, clean images without watermarks fall outside our system's operational scope and can be conservatively regarded "fully tampered." To assess practical reliability, measure false positives in two scenarios: (1) untampered regions within partially tampered watermarked images, and (2) fully untampered, watermarked images. As shown in Tab. 9 our method achieves the lowest false positive rate (measured as the ratio of false positive pixels to the total number of untampered pixels) in both cases, demonstrating its robustness and reliability.
E.6 Performance across Different Tampering Types
We also conducted per-type analysis of tampering detection accuracy, as reported in Tab. 10 Our approach consistently delivers strong performance across diverse manipulation types, underscoring its robustness and generalizabiltty.
26

---

Table 10: Tampering performance of our method under different tampering types on the AIGC tampering dataset.
SD-XL
Kandinsky
ControlNet
[58
Type
Fi7
AUCT
1oU"
Fir
AUCT
1oUT
F11
AUCT
1oLT
F11
AUCT
loU
Fit
AUCT
loUT
Splicing
0.975
0.991
0.963
0.984
0.994
0.965
0.985
0.993
0.964
0,984
0.994
0.963
0.982
0.995
0.965
Copy-and paste
0.978
0.990
0.958
0.976
0.986
0.959
0.980
0.989
0.961
0.978
0.987
0.957
0.976
0.991
0.960
Removal
0,981
0.961
Inpointing
0,987
0.997
0.962
0.982
0.995
0.54
0.77
0.956
0.953
0.981
0.998
0.968
0,744
0.998
0.911
Table 11: Performance under various degradations on AIGC tampering dataset.
EditGuard
21
OmniGuard
22
WAM
23
Ours
Type
Ace.
Fif
Bit Acc.1
Fif
Acc.
FIf
Bit Acc.1
F1
Clean
99.78
0.938
98.11
0.863
98.17
0.920
99.98
0.972
JPEG (Q=30)
62.30
0.230
63.34
0.311
80.96
0.532
98.87
0.866
WebP (Q=50)
52.88
0.233
56.16
0.307
84.87
0.538
98.95
0.703
HEIC (Q=50)
66.53
0.335
59.41
0.323
87.46
0.402
98.36
0.748
Resale (0.25)
41.77
0,256
54.95
0.343
95.98
0.821
97.55
0.858
Brightness (0.8-1.2)
91.35
0.504
89.55
0.741
94.71
0.816
98.94
0.860
Contrast (0.8-1.2)
90.84
0.788
91.45
0.836
95.00
0.824
97.93
0.836
Saturation (0.8-1.2)
92.93
0.817
93.44
0.856
95.69
0.814
97.98
0.911
E.7
Robustness under Real- World Image Degradations
To evaluate real-world applicability, we conducted additional experiments with diverse image degra- dation operations, including: (1) aggressive compression, (2) severe resolution downsampling, and (3) color transformations. The parameter ranges for each transformation are summarized Tab, IT] As shown in the results, our framework maintains high watermark extraction accuracy and reasonable tampering localization performance. This observation aligns with our design intuition: watermark extraction leverages global cues that are relatively robust to distortions, whereas tampering localiza- tion relies on local consistency, making it more sensitive to compression and resampling artifacts. Importantly, the decline in localization accuracy remains moderate and within acceptable limits, highlighting the resilience of our method in real-world scenarios.
E.8 More Visual Results
Fig. 7 and Fig. 8 present additional visual results of tampering localization on the AIGC tampering dataset of COCO (56) and T2I Dataset, respectively. Please zoom in for the best view.
F Disseussion and Limitations
StableGuard is specifically designed for image latent diffusion models. However, since watermarking applied solely through the variational autoencoder decoder within the latent diffusion framework, our approach can be naturally extended to video latent diffusion models. Given the rapid progress this area, adapting our method to the video domain represents an important direction for future research.
While our approach maintains strong performance under certain levels of image degradation, is not entirely immune to the decline in forensic accuracy caused by such distortions. Addressing the sensitivity of forensic performance to image degradation remains current limitation of our method and key focus for future investigation.
27

---

Figure The visualization of tampering localization results on the AIGC tampering dataset of
COCO part. (a) is the original image, (b) is the watermarked image by StableGuard, (c) is the
tampered image, (d)-(m) are the tampering localization results MVSS-Net [5], IML-ViT -VT [16]
PSCC-Net [1]. ObjectFormer (8), HDF-Net [19), EditGuard [21. OmniGuard 22 WAM 23
our StableGuard, and the ground truth, respectively.
28

---

(2)
(b)
(0)
(c)
(
do
Figure 8: The visualization of tampering localization results on the AIGC tampering dataset of T2I dataset part. (a) is the original image, (b) the watermarked image by StableGuard, (c)
tampered image, (d)-(m) are the tampering localization results of MVSS-Net [15], IML-VIT [16],
PSCC-Net [17], ObjectFormer [88. HDF-Net [19), EditGuard (1], OmniGuard 22 WAM 23
StableGuard, and the ground truth, respectively.
29


Reviews:
[{"review_id": "hqX3KywtGo", "reviewer": "Reviewer_Fd7Y", "summary": "The work proposes a novel framework StableGuard to address the need for robust copyright protection and tampering detection in images generated by LDMs. The framework consists of two components: Multiplex Watermark VAE (MPW-VAE) and Mixture-of-Experts Guided Forensic Network (MoE-GFN) which are optimized jointly in a self-supervised fashion. MPW-VAE integrates watermark via residual-based adapters which are inserted after each VAE decoder block. MoE-GFN consists of three blocks: Watermark extraction, Tampering localization and Boundary enhancement and for all three of these, a dynamic soft router is employed to adapt task relevant features. StableGuard is trained on COCO training set and evaluated on COCO test set and custom T2I dataset. It is evaluated for both watermark extraction and tampering localization tasks.", "questions": "- For evaluation of watermark extraction, only quantitative comparison has been shown in Table 1. Figure 3 only shows the qualitative results of the proposed solution, it would be good to see the qualitative comparison with the existing methods also to access the visual quality of the watermarked images for all methods.\n- For quantitative comparisons, one of the recent work is missing:\na. Zhang, X., Tang, Z., Xu, Z., Li, R., Xu, Y., Chen, B., Gao, F. and Zhang, J., 2025. Omniguard: Hybrid manipulation localization via augmented versatile deep image watermarking. In Proceedings of the Computer Vision and Pattern Recognition Conference (pp. 3008-3018).\n- For WEE, TLE, BEE more discussion is required for each component contribution, in ablation study 3rd, 4th and 5th rows marks very minor difference for F1, AUC, IoU and Bit accuracy with respect to each other. It raises the question of why three different extraction methods were required in the first place?\n- Details of custom T2I dataset used for evaluation of watermark extraction are limited, as this is custom it would be beneficial to see the stats of the prompts used for this dataset generation like diversity of this dataset, which categories were used for selection, how were these selected?\n- Eq.(8) mentions LPIPS as Similarity loss, I think the correct version of mentioning LPIPS here is perceptual loss as we are defining the loss function and LPIPS is mostly used as an evaluation term.", "limitations": "NA", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 4, "significance": 4, "originality": 4, "strengths_and_weaknesses": "Strengths:\n+ The paper is well-written and easy to understand.\n+ The idea of joint optimization of watermark integration and tampering localization is novel and interesting.\n+ Evaluations show state-of-the-art results in forensic accuracy and robustness.", "was_revised": true, "final_justification": "All of the concerns have been addressed by the authors, and comparison results are also shown showing the effectiveness of the proposed method.", "rebuttal": "Thank you for your insightful comments and valuable suggestions. We have revised our paper based on your feedback. Here are our responses to your comments:\n\n> **Q1**: For evaluation of watermark extraction, only quantitative comparison has been shown in Table 1. Figure 3 only shows the qualitative results of the proposed solution, it would be good to see the qualitative comparison with the existing methods also to access the visual quality of the watermarked images for all methods.\n\n **A1**: Thank you for the constructive suggestion. Due to the text-only policy of the rebuttal, we are unable to include visualizations at this stage. We will incorporate these results in the revision.\n\n> **Q2**: For quantitative comparisons, one of the recent work is missing: a. Zhang, X., Tang, Z., Xu, Z., Li, R., Xu, Y., Chen, B., Gao, F. and Zhang, J., 2025. Omniguard: Hybrid manipulation localization via augmented versatile deep image watermarking. In Proceedings of the Computer Vision and Pattern Recognition Conference (pp. 3008-3018).\n\n **A2**: We appreciate the reviewer’s suggestion to include OmniGuard [1] for a more comprehensive comparison. We have conducted additional experiments and incorporated quantitative results for OmniGuard in Tables 1 and 2 below. Our method consistently outperforms OmniGuard in both watermark extraction fidelity and tampering localization accuracy. These results, along with a detailed visual comparison, will be included in the revised version of the paper.\n\n \n**Table 1**: Quantitative comparison on watermarking performance on COCO and the T2I dataset.\n|     Method       |     B.L.    |     COCO     |              |              |             |                 |     T2I     |              |              |             |                 |\n|------------------|-------------|---------------------|--------------|--------------|-------------|-----------------|--------------------|--------------|--------------|-------------|-----------------|\n|                  |             |     PSNR↑            |     SSIM↑     |     LPIPS↓    |     FID↓     |     Bit Acc.↑    |     PSNR↑           |     SSIM↑     |     LPIPS↓    |     FID↓     |     Bit Acc.↑    |\n|     OmniGuard    |     100     |     37.54           |     0.950    |     0.072    |     20.1    |     98.11       |     37.32          |     0.944    |     0.070    |     20.0    |     98.09       |\n|     Ours         |     128     |     **40.10**       |     **0.966** |     **0.070**    |     **19.9**    |     **99.87**       |     **40.11**          |     **0.968**    |     **0.069**    |     **19.8**    |     **99.88**       |\n\n**Table 2**: Localization precision comparison on the AIGC tampering dataset.\n|     Method       |     SD-Inp.    |              |              |     SD-XL    |              |              |     Kand.    |              |              |     Cont.    |              |              |     LAMA     |              |              |\n|------------------|:----------------------:|:--------------:|:--------------:|:--------------:|:--------------:|:--------------:|:------------------:|:--------------:|:--------------:|:-------------------:|:--------------:|:--------------:|:--------------:|:--------------:|:--------------:|\n|                  |     F1↑               |     AUC↑      |     IoU↑      |     F1↑       |     AUC↑      |     IoU↑      |     F1↑           |     AUC↑      |     IoU↑      |     F1↑            |     AUC↑      |     IoU↑      |     F1↑       |     AUC↑      |     IoU↑      |\n|     OmniGuard    |     0.853            |     0.964    |     0.810    |     0.867    |     0.973    |     0.824    |     0.868        |     0.966    |     0.830    |     0.858         |     0.965    |     0.815    |     0.864    |     0.969    |     0.823    |\n|     Ours         |     **0.980**            |     **0.993**    |     **0.962**    |     **0.981**    |     **0.991**    |     **0.961**    |     **0.980**        |     **0.992**    |     **0.960**    |     **0.981**         |     **0.993**    |     **0.963**    |     **0.979**    |     **0.993**    |     **0.961**    |\n\n> **Q3**: For WEE, TLE, BEE more discussion is required for each component contribution, in ablation study 3rd, 4th and 5th rows marks very minor difference for F1, AUC, IoU and Bit accuracy with respect to each other. It raises the question of why three different extraction methods were required in the first place?\n\n **A3**: Each expert in the proposed MoFE module is designed to extract a specific and complementary forensic signal: the Watermark Extraction Expert (WEE) captures global watermark patterns, the Tampering Localization Expert (TLE) focuses on localized inconsistencies, and the Boundary Enhancement Expert (BEE) enhances sensitivity to structural boundaries indicative of manipulation. Although the individual removal of these experts (rows 3–5 in Table 4) results in only modest drops in F1, AUC, IoU, and Bit Accuracy, this is primarily due to the model operating near a performance ceiling, where marginal gains from each expert appear limited in isolation.\n\nHowever, their contributions are complementary rather than redundant. The significantly larger performance drop observed when the entire MoFE module is removed (row 2) clearly demonstrates their combined effectiveness. This indicates that while each expert alone contributes moderately, their integration is crucial for the model’s robustness and accuracy.\n\nWe will revise the manuscript to make this design rationale and its empirical support more explicit, including further discussion of the roles of each expert and their synergistic effect (as illustrated in Figure 5).\n\n> **Q4**: Details of custom T2I dataset used for evaluation of watermark extraction are limited, as this is custom it would be beneficial to see the stats of the prompts used for this dataset generation like diversity of this dataset, which categories were used for selection, how were these selected?\n\n **A4**: To ensure semantic diversity and broad coverage of visual concepts in our T2I dataset, we curated prompts from five distinct thematic categories: natural landscapes, urban cityscapes, indoor scenes, animals, and human-centric scenes. For each category, we constructed 200 unique prompts, resulting in 1,000 diverse text inputs spanning a wide range of visual attributes. Specifically, to balance structural consistency with semantic variability, these prompts were generated by combining curated templates with randomized keyword insertions from controlled vocabularies. Each prompt was used to synthesize 10 images, yielding 10,000 generated samples in total. \n \n We will include a detailed summary of prompt statistics, selection methodology, and representative examples in the revised version, and will release the full dataset (including prompts, original images, and tampering images) to facilitate future research.\n\n> **Q5**: Eq. (8) mentions LPIPS as Similarity loss, I think the correct version of mentioning LPIPS here is perceptual loss as we are defining the loss function and LPIPS is mostly used as an evaluation term.\n\n **A5**: We will fix this in the revision.\n\n> **Q6**: Section 3.5 explains the loss functions of the proposed framework as a different section, as Section 3.3 and 3.4 already discusses the main components of the proposed framework, it would be more readable if 3.5 could be integrated within 3.3 and 3.4\n\n **A6**: We will revise this accordingly.\n\n[1] *Zhang X, et al. Omniguard: Hybrid manipulation localization via augmented versatile deep image watermarking, CVPR 2025.*"}, {"review_id": "rmMchM6O8J", "reviewer": "Reviewer_DW9k", "summary": "The paper introduces StableGuard, a unified diffusion-native framework designed to both embed imperceptible binary watermarks during latent diffusion model (LDM) generation and later verify ownership and localise tampered regions in potentially manipulated images.The core component, Multiplexing-Watermark VAE (MPW-VAE), leverages lightweight residual “watermark adapters” inserted after each decoder block. By toggling adapters on or off, the same latent code yields visually identical watermarked and clean pairs, enabling fully self-supervised training. A Mixture-of-Experts Guided Forensic Network (MoE-GFN) combines three specialised branches—watermark extraction, tamper localisation, and boundary refinement—via a dynamic soft routing mechanism. The entire system is trained end-to-end with a combined similarity, watermark, and tamper loss, so watermark embedding and forensic signal learning reinforce each other. Comprehensive experiments on COCO, a 10k text-to-image dataset, and five tampering benchmarks demonstrate higher watermark bit-accuracy, improved fidelity, and substantially stronger localisation compared to post-hoc watermarking baselines and state-of-the-art passive detectors (MVSS-Net, HDF-Net). Ablation studies confirm the contributions of each module.", "questions": "1.How does StableGuard perform under severe downsampling (e.g., 1024→256 px) or aggressive social-media recompression (JPEG Q=30, WebP, HEIC)? Including such experiments would significantly strengthen the practical relevance of your results.\n\n2.For real-world deployment, what are the actual latency and VRAM requirements when generating 1024×1024 images with MPW-VAE, compared to vanilla Stable Diffusion? A table with runtime per image on a modern GPU (e.g., RTX 4090) would be highly informative.\n\n3.Your training masks are random binary regions, whereas real tampering often aligns with semantic boundaries. Have you experimented with using SAM-based masks or object-aware masks to narrow this domain gap?", "limitations": "Yes.", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "This paper demonstrates several notable strengths.\n1.The paper presents a well-designed approach with clear algorithmic formulation, sensible loss functions, and comprehensive ablation studies. The authors thoroughly evaluate the impact of MPW-VAE variants, expert configurations, and routing strategies, which strengthens the credibility of the results.\n\n2.Experiments cover multiple degradation scenarios (noise, JPEG compression, Poisson noise), demonstrating that the method remains effective under moderate distortions.\n\n3.The work addresses an important and timely problem: provenance verification and tamper localisation for AI-generated images. The results show that end-to-end joint training of watermark embedding and localisation can achieve substantial gains over existing post-hoc methods.\n\nHowever, there are also important weaknesses to consider. \n1.All localisation benchmarks are synthetic and based on LDM-generated edits; there is no evaluation on human-made forgeries or realistic manipulations such as colour grading, rescaling, or recompression commonly seen in the wild.\n\n2.Computational costs are reported only in FLOPs, without details on actual runtime latency or memory footprint during inference, making it difficult to assess feasibility for deployment.\n\n3.The experiments do not address resilience to aggressive real-world compression, and the false-positive rate on clean, non-watermarked images remains unexplored, which raises concerns about practical reliability.", "was_revised": true, "final_justification": "Based on previous comments and the author's response, I keep my score.", "rebuttal": "Thank you for your insightful comments and valuable suggestions. We have revised our paper based on your feedback. Here are our responses to your comments:\n\n> **Q1**: All localisation benchmarks are synthetic and based on LDM-generated edits; there is no evaluation on human-made forgeries or realistic manipulations such as colour grading, rescaling, or recompression commonly seen in the wild.\n\n **A1**: We believe there might be a misunderstanding. We have indeed conducted comparison experiments on five standard tampering localization datasets involving human-made forgeries: CASIA, NIST16, Columbia, Coverage, and IMD20, as detailed in *Appendix Section F*. These datasets cover various manipulations, including splicing, copy-move, object removal, etc. The reported results demonstrate the superior performance and practical effectiveness of our method in handling real-world forgery scenarios.\n\n For experimental results on real-world image degradation, such as color transformations and aggressive compression, please refer to **A4**.\n\n> **Q2**: Computational costs are reported only in FLOPs, without details on actual runtime latency or memory footprint during inference, making it difficult to assess feasibility for deployment.\n\n **A2**: Thank you for your suggestion. We run additional experiments to assess inference latency and VRAM usage on an RTX 4090 GPU for our MPW-VAE, the vanilla Stable Diffusion VAE, and the MoE-GFN forensic network (evaluated at 512×512). Results are in Table 1.\n\nOur findings show that MPW-VAE adds negligible overhead compared to the vanilla VAE in latency and VRAM, while the MoE-GFN model performs efficiently, making the framework viable for practical forensic deployment.\n\nTable 1. Statistics of runtime latency and VRAM on the AIGC tampering dataset.\n|   Metric             |     Vanilla VAE    |     MPW-VAE       |     MoE-GFN      |\n|----------------|--------------------|-------------------|------------------|\n|     Latency    |     12.69 ms       |     14.99 ms      |     91.88 ms     |\n|     VRAM       |     1681.93 MB     |     2033.97 MB    |     428.32 MB    |\n\n\n> **Q3**: The experiments do not address resilience to aggressive real-world compression, and the false-positive rate on clean, non-watermarked images remains unexplored, which raises concerns about practical reliability.\n\n **A3**: For robustness to aggressive compression, please refer to **A4**, where we provide comprehensive evaluations under various degradations.\n\nAs for the concern about false positives on clean, non-watermarked images, we would like to clarify that our method is specifically designed as a proactive watermarking framework [1,2,3], in which the watermark serves as a critical bridge to achieve copyright protection and tampering localization simultaneously. Unlike passive detection methods, our approach assumes that images are proactively embedded with a watermark at creation time. As such, clean images without watermarks fall outside the operational scope of our system and can be conservatively interpreted as “fully tampered”.\n\nGiven this design, evaluating false positives on truly non-watermarked images is not applicable. Instead, we assess practical reliability by measuring false positive detections in (1) untampered regions of partially tampered watermarked images and (2) fully untampered, watermarked images. As shown in Table 2, our method achieves the lowest false positive rate (defined as the ratio of false positive pixels to the total untampered pixel count) in both cases, demonstrating its effectiveness and reliability.\n\nWe will include these results and explanations in the revised manuscript to clarify the motivation and scope of our framework.\n\nTable 2. Comparison of false positive rate (FPR ↓) on the AIGC tampering dataset.\n|     Type             |     EditGuard    |     OmniGuard    |     WAM        |     Ours       |\n|---------------------|------------------|------------------|----------------|----------------|\n|     Partially tampered        |     0.0422       |     0.0191       |     0.0045     |     **0.0023**     |\n|     Fully untampered      |     0.0028       |     0.0024       |     0.0019     |     **0.0016**     |\n\n> **Q4**: How does StableGuard perform under severe downsampling (e.g., 1024→256 px) or aggressive social-media recompression (JPEG Q=30, WebP, HEIC)? Including such experiments would significantly strengthen the practical relevance of your results.\n\n **A4**: We have conducted additional experiments involving a diverse set of image degradation operations, representative of real-world scenarios. These include: (1) aggressive image compression, (2) severe resolution downsampling (1024→256 px is equivalent to a rescale factor of 0.25), and (3) color transformations. The specific parameter ranges for each transformation are summarized in the table below.\n\nAs shown in the results, our method maintains high watermark extraction accuracy and exhibits reasonable tampering localization performance. This behavior is consistent with our design intuition: watermark extraction relies on global cues, which are more robust to distortions, while tampering localization depends on local consistency, and is naturally more sensitive to compression and resampling artifacts. Nevertheless, the degradation in localization performance remains moderate and within acceptable bounds. These results confirm the real-world applicability and resilience of our approach.\n\nWe will incorporate these results in the revised version.\n\n**Table 3**. Performance under various degradations on AIGC tampering dataset.\n|     Type                 |     EditGuard |              |     OmniGuard    |              |        WAM      |              |       Ours      |           |\n|----------------------|:-------------:|:------------:|:----------------:|:------------:|:---------------:|:------------:|:---------------:|:---------:|\n|                      |    Bit Acc.↑   |      F1↑      |      Bit Acc.↑    |       F1↑     |     Bit Acc.↑    |       F1↑     |     Bit Acc.↑    |     F1↑    |\n|     Clean            |       99.78   |     0.938    |       98.11      |     0.863    |       98.17     |     0.920    |    **99.98**    | **0.972** |\n|     JPEG (Q=30)      |       62.30   |     0.230    |       63.34      |     0.311    |       80.96     |     0.532    |    **98.87**    | **0.866** |\n|     WebP (Q=50)      |       52.88   |     0.233    |       56.16      |     0.307    |       84.87     |     0.538    |    **98.95**    | **0.703** |\n|     HEIC (Q=50)      |       66.53   |     0.335    |       59.41      |     0.323    |       87.46     |     0.402    |    **98.36**    | **0.748** |\n|     Resale (0.25)    |       41.77   |     0.256    |       54.95      |     0.343    |       95.98     |     0.821    |    **97.55**    | **0.858** |\n| Brightness (0.8-1.2) |     91.35     |     0.504    |       89.55      |     0.741    |       94.71     |     0.816    |    **98.94**    | **0.860** |\n| Contrast (0.8-1.2)   |     90.84     |     0.788    |       91.45      |     0.836    |       95.00     |     0.824    |    **97.93**    | **0.836** |\n| Saturation (0.8-1.2) |     92.93     |     0.817    |       93.44      |     0.856    |       95.69     |     0.814    |    **97.98**    | **0.911** |\n\n> **Q5**: For real-world deployment, what are the actual latency and VRAM requirements when generating 1024×1024 images with MPW-VAE, compared to vanilla Stable Diffusion? A table with runtime per image on a modern GPU (e.g., RTX 4090) would be highly informative.\n\n **A5**: We compared inference latency and VRAM usage of our MPW-VAE with the vanilla Stable Diffusion VAE for generating 1024×1024 images in Table 4. Our MPW-VAE shows similar runtime and memory consumption to the original VAE, with only minimal overhead, proving its efficiency for practical deployment.\n\nTable 4. Latency and VRAM usage of MPW-VAE vs. vanilla Stable Diffusion VAE.\n|     Metric    |     Vanilla VAE    |     MPW-VAE       |\n|----------------|--------------------|-------------------|\n|     Latency    |     127.03 ms      |     169.40 ms     |\n|     VRAM       |     4598.30 MB     |     6006.15 MB    |\n\n>**Q6**: Your training masks are random binary regions, whereas real tampering often aligns with semantic boundaries. Have you experimented with using SAM-based masks or object-aware masks to narrow this domain gap?\n\n **A6**: Thank you for your careful comment. In our implementation, we employed a hybrid masking strategy that combines both random binary masks and semantic-aware masks to simulate diverse tampering patterns. Specifically, with 50% probability, we apply random binary masks, while for the remaining 50%, we utilize segmentation maps extracted by SAM. These SAM-based masks are randomly drawn from a pre-collected pool of segmentation shapes and are not image-paired, allowing us to inject shape diversity without requiring additional supervision.\n\nHowever, in the original manuscript, we referred to this mask generation process in a simplified manner as “random binary masks”, which may have caused confusion. We will revise the manuscript to clearly reflect the actual hybrid masking strategy, thereby providing a more accurate description of our method. We will also release our code, pre-trained models, and datasets to facilitate reproducibility and foster future research upon acceptance.\n\n\n> **Q7**: Figure 2(b) labels are too small to read at print scale; consider enlarging the font size.\n\n **A7**: We will revise this in the revision.\n\n [1] *Zhang X, et al. Editguard: Versatile image watermarking for tamper localization and copyright protection,  CVPR 2024.* \\\n [2] *Zhang X, et al. Omniguard: Hybrid manipulation localization via augmented versatile deep image watermarking, CVPR 2025.* \\\n [3] *Sander T, et al. Watermark Anything With Localized Messages, ICLR 2025.*"}, {"review_id": "HddpLBUeEh", "reviewer": "Reviewer_9vPj", "summary": "This work proposes a method for both copyright protection and image manipulation localization using Stable Diffusion models. Specifically, it introduces two novel components: (1) MPW-VAE, which generates both watermarked and watermark-free images for self-supervised learning, and (2) MoE-GFN, which is designed for watermark verification and manipulation localization.", "questions": "1) The paper mentions that random splicing is applied after MPW-VAE. Could the authors clarify why only splicing is considered? What would be the effect of applying other manipulation types, such as random copy-move or random removal, in this step?\n2) What is the approximate inference time of the proposed model for processing a single image, including both watermark verification and manipulation localization?", "limitations": "Yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1) The paper is well-written, with clear and detailed descriptions of the proposed method.\n2) The proposed approach achieves improved performance over state-of-the-art methods.\n3) The experiments and ablation studies are thorough and well-designed.\n\nWeaknesses:\n1) The use of self-supervised learning has been explored in prior works [1][2], but these related methods are not discussed in the related work section.\n2) Table 2 does not specify the manipulation types or the number of samples per type for the evaluated datasets.\n3) The performance across different manipulation types should be reported to better understand the method's effectiveness in various scenarios.\n\n\n\n[1] Zhai, Yuanhao, Tianyu Luan, David Doermann, and Junsong Yuan. \"Towards generic image manipulation detection with weakly-supervised self-consistency learning.\" In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 22390-22400. 2023.\n\n[2] Zhang, Zhenfei, Mingyang Li, Xin Li, Ming-Ching Chang, and Jun-Wei Hsieh. \"Image Manipulation Detection with Implicit Neural Representation and Limited Supervision.\" In European Conference on Computer Vision, pp. 255-273. Cham: Springer Nature Switzerland, 2024.", "was_revised": true, "final_justification": "After reviewing the rebuttal, I believe the authors have satisfactorily addressed my concerns. I consider this a solid piece of work and maintain my rating of Accept.", "rebuttal": "Thank you for your insightful comments and valuable suggestions. We have revised our paper based on your feedback. Here are our responses to your comments:\n\n> **Q1**: The use of self-supervised learning has been explored in prior works [1][2], but these related methods are not discussed in the related work section.\n\n **A1**: Thank you for suggesting the relevant works. While both [1] and [2] explore semi-supervised tampering localization, their problem settings and methodological designs differ substantially from ours.\n\n 1) Our proposed StableGuard is a unified framework that integrates both proactive watermarking and tampering localization, whereas [1] and [2] focus exclusively on passive tampering detection.\n 2) StableGuard operates in a proactive protection setting, where imperceptible watermarks are injected into protected images in advance. In contrast, [1] and [2] are post-hoc forensic methods that analyze tampering without any prior intervention or watermark signal.\n 3) Our method employs a fully self-supervised training paradigm, requiring no manual annotations. In comparison, [1] and [2] adopt semi-supervised learning and still rely on image-level supervision.\n\n We will incorporate a more thorough discussion of these works and their distinctions from ours in the revision.\n\n> **Q2**: Table 2 does not specify the manipulation types or the number of samples per type for the evaluated datasets.\n\n **A2**: The AIGC tampering dataset used for evaluation consists of 35,000 manipulated images, generated by five representative generative models and evenly distributed across four common tampering types: splicing, copy-and-paste, object removal, and inpainting. Each tampering category contains 8,750 samples, enabling a balanced and comprehensive evaluation across manipulation types.\n\n We will include this clarification in the revised manuscript.\n\n> **Q3**: The performance across different manipulation types should be reported to better understand the method's effectiveness in various scenarios.\n\n **A3**: In our original manuscript, we strictly followed the evaluation protocol established in prior works [3,4,5], where average performance across manipulation types is reported as the primary metric. This choice was made to ensure an intuitive and fair comparison with existing methods, while adhering to the space constraints of the main paper.\n\n Nevertheless, we have conducted a per-type performance analysis, as presented in Table 1 below. The results indicate that our method consistently achieves strong performance across all manipulation types, underscoring its robustness and generalizability in diverse tampering scenarios.\n \n Moreover, *Appendix Section F* of our original manuscript also presents additional experiments on real-world tampering datasets covering a variety of manipulation scenarios, which further support the generalizability and effectiveness of our method in practical applications.\n\n We will include these results and the corresponding discussions in the revision.\n \n\nTable 1. Tampering performance of our method under different tampering types on the AIGC tampering dataset.\n|     Type       |     SD-Inp.    |              |              |     SD-XL    |              |              |     Kand.    |              |              |     Cont.    |              |              |     LAMA     |              |              |\n|------------------|:----------------------:|:--------------:|:--------------:|:--------------:|:--------------:|:--------------:|:------------------:|:--------------:|:--------------:|:-------------------:|:--------------:|:--------------:|:--------------:|:--------------:|:--------------:|\n|                       |     F1↑        |     AUC↑     |     IoU↑     |     F1↑      |     AUC↑     |     IoU↑     |     F1↑      |     AUC↑     |     IoU↑     |     F1↑      |     AUC↑     |     IoU↑     |     F1↑      |     AUC↑     |     IoU↑     |\n|     Splicing          |     0.975      |     0.991    |     0.963    |     0.984    |     0.994    |     0.965    |     0.985    |     0.993    |     0.964    |     0.984    |     0.994    |     0.963    |     0.982    |     0.995    |     0.965    |\n|     Copy-and-paste    |     0.978      |     0.990    |     0.958    |     0.976    |     0.986    |     0.959    |     0.980    |     0.989    |     0.961    |     0.978    |     0.987    |     0.957    |     0.976    |     0.991    |     0.960    |\n|     Removal           |     0.980      |     0.994    |     0.965    |     0.982    |     0.989    |     0.966    |     0.978    |     0.990    |     0.962    |     0.981    |     0.993    |     0.964    |     0.984    |     0.988    |     0.968    |\n|     Inpainting        |     0.987      |     0.997    |     0.962    |     0.982    |     0.995    |     0.954    |     0.977    |     0.996    |     0.953    |     0.981    |     0.998    |     0.968    |     0.974    |     0.998    |     0.951    |\n\n\n> **Q4**: The paper mentions that random splicing is applied after MPW-VAE. Could the authors clarify why only splicing is considered? What would be the effect of applying other manipulation types, such as random copy-move or random removal, in this step?\n\n**A4**: We adopt random splicing as our manipulation strategy during training because it offers a simple yet effective means for simulating a wide range of real-world tampering patterns, while preserving the self-supervised nature of our framework.\n\nSpecifically, random splicing combines a watermarked and a non-watermarked version of the same image using randomly generated binary masks. This technique produces tampered samples that are visually indistinguishable and structurally coherent, both globally and locally. As a result, the model can learn subtle forensic cues without the need for manual annotations.\n\nFurthermore, by splicing the watermarked and non-watermarked versions of the same image, we ensure semantic alignment between the image regions. This is particularly challenging to achieve with techniques like copy-move or removal, since these tampering can often introduce unnatural boundaries or structural inconsistencies, especially in complex scenes. Our strategy enables the model to learn from more complex and challenging examples.\n\nCrucially, by training on spliced images that involve arbitrary pixel-level replacement, our model naturally generalizes to a broad range of tampering types that involve pixel-level modifications at test time, including but not limited to copy-move, random object removal, and inpainting. This generalization capability has been empirically validated through extensive experiments on both synthetic manipulations and real-world tampering datasets, presented in the main paper (e.g., *Section 4.3* in the main paper and *Section F* in the appendix).\n\nWe will include these clarifications regarding our training manipulation strategy in the revision.\n\n> **Q5**: What is the approximate inference time of the proposed model for processing a single image, including both watermark verification and manipulation localization?\n\n**A5**: We have conducted additional experiments to measure the inference latency and memory usage of our framework. The detailed performance metrics are summarized in the table below. Specifically, we evaluated the inference time and memory of both our MPW-VAE and the baseline Stable Diffusion VAE (evaluated at 512 × 512), as well as the runtime performance of the MoE-GFN forensic network under the same setting. The results show that MPW-VAE introduces negligible additional computational overhead compared to the original diffusion VAE. Furthermore, the MoE-GFN model exhibits favorable runtime efficiency, with both inference latency and memory consumption remaining within acceptable ranges for practical deployment scenarios.\n \n We will include these results in the revision.\n\nTable 1. Statistics of runtime latency and VRAM on the AIGC tampering dataset.\n|     Metric           |     Vanilla VAE    |     MPW-VAE       |     MoE-GFN      |\n|----------------|--------------------|-------------------|------------------|\n|     Latency    |     12.69 ms       |     14.99 ms      |     91.88 ms     |\n|     VRAM       |     1681.93 MB     |     2033.97 MB    |     428.32 MB    |\n\n [1] *Zhai Y, et al. Towards generic image manipulation detection with weakly-supervised self-consistency learning, ICCV 2023.* \\\n [2] *Zhang Z, et al. Image Manipulation Detection with Implicit Neural Representation and Limited Supervision, ECCV 2024.* \\\n [3] *Zhang X, et al. Editguard: Versatile image watermarking for tamper localization and copyright protection,  CVPR 2024.* \\\n [4] *Zhang X, et al. Omniguard: Hybrid manipulation localization via augmented versatile deep image watermarking, CVPR 2025.* \\\n [5] *Sander T, et al. Watermark Anything With Localized Messages, ICLR 2025.*"}, {"review_id": "8SjMVdNbcl", "reviewer": "Reviewer_4kgq", "summary": "This paper presents StableGuard, a unified framework for copyright protection and tampering localization based on a global watermark embedded during the diffusion process. The MPW-VAE module ensures that the embedded watermark maintains high visual fidelity in the watermarked images. In addition, the MoE-GFN module integrates three experts: Watermark Extraction, Tampering Localization, and Boundary Detection. These modules work together to improve the accuracy of forensic analysis.", "questions": "1. In Equation (3), why is the fusion based on a random choice between $X$and$\\hat{X}$? It seems that using either one consistently might be sufficient.\n\n2. The paper provides detailed descriptions of each module. However, the architecture of the forensic decoder is not clearly explained. Could the authors briefly describe its structure?\n\n[1]Sander, Tom, et al. \"Watermark Anything with Localized Messages.\" Proceedings of the International Conference on Learning Representations. 2025.", "limitations": "yes", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "### Strengths\n\n1. The paper is clearly written, with detailed explanations of the proposed method and its components.\n\n2. The work introduces a diffusion-based watermark for tampering localization by embedding watermarks during the image generation process. This provides a valuable supplement to the field.\n\n### Weaknesses\n\n1. The proposed method uses a single watermark to achieve both copyright protection and tampering localization, which involves a trade-off between robustness and localization sensitivity. Although the authors employ two expert modules for extracting different features, it seems that the final decision relies on $x_{unified}$​. When the tampered region becomes large, this may reduce watermark extraction accuracy. It would be helpful if the authors could report the performance of watermark extraction under different tampering ratios.\n\n2. The robustness of the method appears to be limited or requires further evaluation. Methods like WAM[1] also support both tampering localization and watermark extraction with a single watermark, and are able to resist a wide range of transformations. A comparison or discussion would strengthen the contribution.", "was_revised": true, "final_justification": "The authors have addressed my concern about scenarios under different tempering rates. Besides, the comparison with WAM also shows their method’s superior performance. Therefore, I increase my score.", "rebuttal": "We thank the reviewer for their thoughtful evaluation and constructive comments. While the points raised are valid and appreciated, they focus on peripheral implementation details that we clarify below.\n\n> **Q1**: The proposed method uses a single watermark to achieve both copyright protection and tampering localization, which involves a trade-off between robustness and localization sensitivity. Although the authors employ two expert modules for extracting different features, it seems that the final decision relies on $x_{unified}$. When the tampered region becomes large, this may reduce watermark extraction accuracy. It would be helpful if the authors could report the performance of watermark extraction under different tampering ratios.\n\n **A1**: We appreciate the comment. We have conducted a comparative analysis of watermark extraction accuracy across different tampering ratios, ranging from 10% to 90%. The results, presented in the table below, show that our method consistently outperforms existing approaches across all tampering levels. This remarkable performance can be attributed to three key factors: \n 1) Our MPW-VAE seamlessly encodes holistic watermark features at multiple scales during the decoding process, which significantly enhances the robustness of watermark embedding. \n 2) The global self-attention mechanism in our watermark extraction expert facilitates the capture of long-range dependencies and contextual cues that remain even when large regions are tampered. \n 3) We introduce randomly generated masks with varying coverage during the training process, including large-area tampering. This encourages the model to generalize well to a wide range of manipulation ratios and improves its ability to extract watermarks even under severe distortions.\n\n We will include these results in the revision.\n\n**Table 1**. Comparison of watermark extraction accuracy (↑) under different tampering rates on the AIGC tampering dataset.\n|     Method   |     10%       |     30%       |     50%       |     70%       |     90%       |\n|------------------|--------------|--------------|--------------|--------------|--------------|\n|     EditGuard    |     99.78    |     99.60    |     97.66    |     90.95    |     69.13    |\n|     OmniGuard    |     98.11    |     98.02    |     96.84    |     91.33    |     83.90    |\n|     WAM          |     98.17    |     97.11    |     94.89    |     93.74    |     88.53    |\n|     Ours     |     **99.98**    |     **99.98**    |     **99.96**    |     **99.27**    |     **89.58**    |\n\n\n> **Q2**: The robustness of the method appears to be limited or requires further evaluation. Methods like WAM [1] also support both tampering localization and watermark extraction with a single watermark, and are able to resist a wide range of transformations. A comparison or discussion would strengthen the contribution.\n\n **A2**: We would first like to highlight a fundamental distinction between our approach and WAM [1]. WAM adopts a post-hoc watermarking strategy, injecting watermarks into pre-generated images, while our method is diffusion-naive and jointly optimized, embedding holistic watermark features directly during the generative process. This design allows for seamless integration of watermark signals with the image content and enables improved resilience to tampering.\n\n In response to your suggestion and in accordance with the comments from Reviewer **#Fd7Y**, we performed a comparative evaluation against two recent representative methods, namely WAM [1] and OmniGuard [2], both of which perform tampering localization using a single post-hoc embedded watermark. As presented in the tables below, our approach consistently outperforms both methods across all evaluated metrics. \n \n Additionally, following the suggestion from Reviewer **#DW9k**, we have included results for our method under various real-world image transformations. Please see **A4** under **#DW9k** for details.\n \n We will include these results, as well as additional visualizations and discussion, in the revised version.\n\n\n\n**Table 2**: Quantitative comparison on watermarking performance on COCO and the T2I dataset.\n|     Method       |     B.L.    |     COCO     |              |              |             |                 |     T2I     |              |              |             |                 |\n|------------------|-------------|---------------------|--------------|--------------|-------------|-----------------|----------------|-----------|--------------|-------------|-------------|\n|                  |             |     PSNR↑            |     SSIM↑     |     LPIPS↓    |     FID↓     |     Bit Acc.↑    |     PSNR↑           |     SSIM↑     |     LPIPS↓    |     FID↓     |     Bit Acc.↑    |\n|     OmniGuard    |     100     |     37.54           |     0.950    |     0.072    |     20.1    |     98.11       |     37.32          |     0.944    |     0.070    |     20.0    |     98.09       |\n|     WAM          |     32      |     38.20           |     0.951    |     0.067    |     19.9    |     98.17       |     37.80          |     0.946    |     0.073    |     19.6    |     98.33       |\n|     Ours     |     32      |     **40.50**           |     **0.970**    |     **0.062**    |     **19.5**    |     **99.97**       |     **40.53**          |     **0.972**    |     **0.060**    |     **19.4**    |     **99.98**       |\n|     Ours     |     128     |     40.10           |     0.966    |     0.070    |     19.9    |     99.87       |     40.11          |     0.968    |     0.069    |     19.8    |     99.88       |\n\n**Table 3**: Localization precision comparison on the AIGC tampering dataset.\n|     Method       |     SD-Inp.    |              |              |     SD-XL    |              |              |     Kand.    |              |              |     Cont.    |              |              |     LAMA     |              |              |\n|-------------|:-----------------:|:-----------:|:-----------:|:-----------:|:--------------:|:--------------:|:------------------:|:--------------:|:--------------:|:----------------:|:--------------:|:--------------:|:--------------:|:--------------:|:--------------:|\n|                  |     F1↑               |     AUC↑      |     IoU↑      |     F1↑       |     AUC↑      |     IoU↑      |     F1↑           |     AUC↑      |     IoU↑      |     F1↑            |     AUC↑      |     IoU↑      |     F1↑       |     AUC↑      |     IoU↑      |\n|     OmniGuard    |     0.853            |     0.964    |     0.810    |     0.867    |     0.973    |     0.824    |     0.868        |     0.966    |     0.830    |     0.858         |     0.965    |     0.815    |     0.864    |     0.969    |     0.823    |\n|     WAM          |     0.924            |     0.977    |     0.868    |     0.918    |     0.976    |     0.862    |     0.921        |     0.976    |     0.865    |     0.917         |     0.977    |     0.860    |     0.922    |     0.967    |     0.864    |\n|   Ours       |     **0.980**            |     **0.993**    |     **0.962**    |     **0.981**    |     **0.991**    |     **0.961**    |     **0.980**        |     **0.992**    |     **0.960**    |     **0.981**         |     **0.993**    |     **0.963**    |     **0.979**    |     **0.993**    |     **0.961**    |\n\n\n\n> **Q3**: In Equation (3), why is the fusion based on a random choice between $X$ and $\\hat{X}$. It seems that using either one consistently might be sufficient.\n\n **A3**:  The random selection between $X$ and $\\hat{X}$ in Equation (3) is intentionally designed to improve the generalization ability of the model across a broader spectrum of tampering types.\n \n Specifically, choosing $X$ (a real image) allows us to simulate conventional tampering patterns typically observed in human-made manipulations, such as those created using image editing tools (e.g., Photoshop). Conversely, using $\\hat{X}$, which is the output reconstructed by the vanilla LDM's VAE, mimics AI-generated forgeries that are increasingly prevalent with the rise of generative models.\n\n By incorporating both sources in a randomized fashion during training, the model is exposed to a wider distribution of tampering artifacts, spanning both traditional and generative forgery patterns. This strategy enables the model to learn more robust representations and improves its applicability to diverse real-world scenarios.\n\n We will incorporate a more detailed explanation of this design choice in the revision.\n\n> **Q4**: The paper provides detailed descriptions of each module. However, the architecture of the forensic decoder is not clearly explained. Could the authors briefly describe its structure?\n\n **A4**: The forensic decoder consists of two parallel decoding heads: \n 1) The mask prediction head is responsible for localizing tampered regions and is implemented as a lightweight two-layer convolutional network.\n 2) The watermark prediction head is used for recovering the embedded watermark and comprises a two-layer convolutional network followed by a fully connected layer. \n \nThis modular design allows the network to jointly optimize for both localization and watermark reconstruction. We will provide a comprehensive description of the forensic decoder in the revised version and make our code, pretrained models, and datasets publicly available to facilitate reproducibility upon acceptance.\n\n [1] *Sander T, et al. Watermark Anything With Localized Messages, ICLR 2025.* \\\n [2] *Zhang X, et al. Omniguard: Hybrid manipulation localization via augmented versatile deep image watermarking, CVPR 2025.*\n\n > **As all concerns have been thoroughly addressed and none pertain to the central novelty, significance, or empirical effectiveness of our approach, we respectfully believe that the borderline rejection rating may not accurately reflect the strength of the submission. We kindly ask the reviewer to reconsider their score in light of our detailed responses.**"}]

Author rebuttal:

Meta-review: The paper proposes a framework for copyright protection and tampering localization in images generated by LDMs. All four reviewers gave positive scores: two borderline accepts and two accepts. The major concerns raised by the reviewers include additional comparisons with two baselines and experimental analysis on the robustness and efficiency. The authors addressed all the concerns during the discussion period. Based on all of these, the decision is to recommend the paper for acceptance.
Decision: Accept (poster)