Shallow Diffuse: Robust and Invisible Watermarking through Low-Dim Subspaces in Diffusion Models
Authors: Wenda Li
Huijie Zhang
Qing Qu
Venue: NeurIPS 2025 spotlight ()
Keywords: diffusion Model
watermark
low-dimensional subspace
consistency
robustness
Primary area: deep_learning

Abstract: The widespread use of AI-generated content from diffusion models has raised significant concerns regarding misinformation and copyright infringement. Watermarking is a crucial technique for identifying these AI-generated images and preventing their misuse. In this paper, we introduce *Shallow Diffuse*, a new watermarking technique that embeds robust and invisible watermarks into diffusion model outputs. Unlike existing approaches that integrate watermarking throughout the entire diffusion sampling process, *Shallow Diffuse* decouples these steps by leveraging the presence of a low-dimensional subspace in the image generation process. This method ensures that a substantial portion of the watermark lies in the null space of this subspace, effectively separating it from the image generation process. Our theoretical and empirical analyses show that this decoupling strategy greatly enhances the consistency of data generation and the detectability of the watermark. Extensive experiments further validate that *Shallow Diffuse* outperforms existing watermarking methods in terms of consistency.

Shallow Diffuse: Robust and Invisible Watermarking through Low-Dim Subspaces in Diffusion Models
Wenda Li" Huijie Zhang" Qing Qu
Department of Electrical Engineering & Computer Science University of Michigan, Ann Arbor
Abstract
The widespread use of Al-generated content from diffusion models has raised significant concerns regarding misinformation and copyright infringement. Wa- termarking is crucial technique for identifying these Al-generated images and preventing their misuse. In this paper, we introduce Shallow Diffuse, new wa- termarking technique that embeds robust and invisible watermarks into diffusion model outputs. Unlike existing approaches that integrate watermarking throughout the entire diffusion sampling process, Shallow Diffuse decouples these steps by leveraging the presence of a low-dimensional subspace in the image generation process. This method ensures that substantial portion of the watermark lies in the null space of this subspace, effectively separating it from the image generation process. Our theoretical and empirical analyses show that this decoupling strategy greatly enhances the consistency of data generation and the detectability of the wa- termark. Extensive experiments further validate that Shallow Diffuse outperforms existing watermarking methods in terms of consistency.
Introduction
Diffusion models 1 have recently become a new dominant family of generative models, powering various commercial applications such as Stable Diffusion 4 DALL-E 5 61, Imagen (7]. Stable Audio [8] and Sora [ These models have significantly advanced the capabilities of text-to-image, text-to-audio, text-to-video, and multi-modal generative tasks. However, the widespread usage of Al-generated content from commercial diffusion models on the Internet has raised several serious concerns: (a) Al-generated misinformation presents serious risks societal stability by spreading unauthorized or harmful narratives on large scale [10 12;; (b) the memorization of training data by those models [7 challenges the originality of the generated content and raises potential copyright infringement issues; (c) iterative training on Al-generated content, known as model collapse 18 can degrade the quality and diversity of outputs over time, resulting in repetitive, biased, or low-quality generations that may reinforce misinformation and distortions in the wild Internet.
To deal with these challenges, watermarking is a crucial technique for identifying Al-generated content and mitigating its misuse. Typically, it can be applied in two main scenarios: (a) the server scenario, where given an initial random seed, the watermark is embedded into the image during the generation process; and (b) the user scenario, where given a generated image, the watermark is injected in post-processee processing manner, (as shown in the left two blocks in Figure top). Traditional watermarking methods (6) are mainly designed for the user scenario, embedding detectable watermarks directly into images with minimal modification. However, these methods are susceptible to attacks. For example, the watermarks can become undetectable with simple corruptions such as blurring on watermarked images. More recent methods considered the server scenario (27 enhancing robustness by integrating watermarking into the sampling process of diffusion models.
'The first and second authors contribute equally to this work.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Original
Watermark
Watermark
Watermark I
Watermark
Watermark
Watermark II
Image
Tree-Ring Watermarks
RingID
Shallow Diffuse (Ours)
Tree-Ring Watermarks
Shallow Diffuse
RingID
1.0
1.0
1.0
TPR@1%FPM
10:8
00.8
11.6
13:6
00.61
30
:55
40
45
0.56
11.8
1.0
1.0
(1.2
0.4
PSNR1
SSIMT
LPIPSJ
Figure I: Comparison between Tree-Ring Watermarks, RingID and Shallow Diffuse. (Top) On the left are the original images, and on the right are the corresponding watermarked images generated using three techniques: Tree-Ring [29 RingID [3]], and Shallow Diffuse. For each technique. we sampled watermarks using two distinct random seeds and obtained the respective watermarked images. (Bottom) Trade-off between consistency (measured by PSNR, SSIM, LPIPS) and robustness (measured by TPR @ (%FPR) for Tree-Ring Watermarks, RingID, and Shallow Diffuse.
For example, recent works 229 31 embed the watermark into the initial random seed in the Fourier domain and then sample image from the watermarked seed. As illustrated in Figure T these methods frequently result in inconsistent watermarked images because they substantially distort the original Gaussian noise distribution. Moreover, since they require access to the initial random seed, limits their use in the user scenario. To the best of our knowledge, there is no robust and consistent watermarking method suitable for both the server and user scenarios (a more detailed discussion of related works is provided in Appendix B)
To address these limitations, proposed Shallow Diffuse, robust and consistent watermarking approach that can be employed for both the server and user scenarios. In contrast to prior works (29 31, which embed watermarks into the initial random seed and tightly couple watermarking with the sampling process, Shallow Diffuse decouples these two steps by exploiting the low-dimensional subspace structure inherent in the generation process of diffusion models 33 34]. The key insight is that, due to the low dimensionality of the subspace, significant portion of the watermark will li in its null space, which effectively separates the watermarking from the sampling process (see Figure [ for an illustration). Our theoretical and empirical analyses demonstrate that this decoupling strategy significantly improves the consistency of the watermark. Moreover, Shallow Diffuse flexible for both server and user scenarios, with better consistency as well as independence from the initial random seed.
Our contributions. In summary, our proposed Shallow Diffuse offers several key advantages over existing watermarking techniques 23 that we highlight below:
Flexibility. Watermarking via Shallow Diffuse works seamlessly under both server-side and user- side scenarios. In contrast, most of the previous methods only focus scenario without an easy extension to the other; see Table and Table 2 for demonstrations.
Consistency and robustness. By decoupling the watermarking from the sampling process, Shallow Diffuse achieves better consistency and comparable robustness. Extensive experiments (Table and Table 2) support our claims, with extra ablation studies in Figure 5aland Figure 5b

---

Provable guarantees. The consistency and detectability of our approach are theoretically justified. Assuming a proper low-dimensional image data distribution (see Assumption TT. we rigorously establish bounds for consistency (Theorem D and detectability (Theorem
2
Preliminaries
We start by reviewing the basics of diffusion models 0 35 followed by several key empirical properties that will be used in our approach: the low-rankness and local lincarity of the diffusion model 33
2.1 Preliminaries on Diffusion Models
Basics of diffusion models. In general, diffusion models consist of two processes:
The forward diffiusion process. The forward process progressively perturbs the original data Do to a noisy sample D; for some integer E [0, 7] with T E Σ. As in [1 this can be characterized by conditional Gaussian distribution pr (Ze (z)) = Nax varaoo (1 (1--a)a. La). Particularly, parameters
{ar) sastify: (i)
1, and thus po = Pdata. and (ii) or = 0, and thus pr (0, Lz).
The reverse sampling process. To generate a new sample, previous works [ 13-37 have proposed various methods to approximate the reverse process of diffusion models. Typically, these methods involve estimating the noise e, and removing the estimated noise from H recursively to obtain an estimate of To. Specifically, One sampling step of Denoising Diffusion Implicit Models (DDIM) [36 from 2G to - can be described as:
St
Va--
+ ar- a0-1 (),
04
where c0(2;, t) is parameterized by neural network and trained to predict the noise e at time t. From previous works [88 (3), the first term in Equation (1) defined as (xx)) is the posterior
mean predictor (PMP) that predict the posterior mean E| [xz] DDIM could also be applied to a clean sample wo and generate the corresponding noisy æ; at time I, named DDIM Inversion. One sampling step of DDIM inversion is similar to Equation (1), by mapping from æ;-1 to øt. For any 4 and l2 with l2 > L, we denote multi-time steps DDIM operator and its inversion as T11- = DDIM( (22 (1) and Ft2 DDIM Inv(m 12).
Text-to-image (T2I) diffusion models & classifier-frre guidance (CFG). The diffusion model can be generalized from unconditional to T2I generation Zp guided by text prompt c. In more detail, when training T2I diffusion models, we optimize conditional denoising function co tt) For sampling, we employ a technique called classifier-free guidance (CFG) 44). which substitutes the unconditional denoiser eg (xx, I) in Equation (1) with its conditional counterpart (0(,,, () that can be described as éØ 1, c) (1 e) (x:, 1, 0) + 7/60 I, c).. Here, Ø denotes the empty prompt, and v) > denotes the strength for the classifier-free guidance. For simplification, for any l and l2 with L2 > 41 we denote multi-time steps CFG operator as It, = CFG t1, c). DDIM and DDIM inversion could also be generalized to T2I version, denoted by It, DDIM(I1,; &1, e) and Dt, DDIM Inv t),
3 4 where the latter enables controllable image
2.2 Local Linearity and Intrinsic Low Low-Dimensionality in PMP
In this work, leverage two key properties of the PMP (a:) introduced in Equation (1) for watermarking diffusion models. Parts of these properties have been previously identified in recent papers [33 42, and have been extensively analyzed in (34). At a given timestep [O,T].
consider the first-order Taylor expansion of the PMP fo. fo. e + Adx) at the point æy;
La (x Adz) == f0.( + (J)) Aæ,
(2)
where Ax E 8d-1 is perturbation direction with unit length, E the perturbation strength, and Ja. = fo. denotes the Jacobian of (0x)) Within certain range of noise levels, the learned PMP fe,; exhibits local lincarity, and its Jacobian Jo, e Rdxd is low rank:
3

---

Server scenario
Watermarking via low-dinhensionll salespace
cha
Null (Jass
AAz
TT
AAx
PPIM
xiy-
Watorrarking my moddl
Range (Ja.s
W
370
W
pr
User Scenario
VPEM
Watormarkang dotection adversarial scenario
Athock
DDIM
Detector( 2 Adr)
Inverse
W
Wovternnr king imagee
Figure 2: Overview of Shallow Diffuse for T2I Diffusion Models. The server scenario (top left) illustrates watermark embedding during generation using CFG, while the user scenario (bottom left) demonstrates post-generation watermark embedding via DDIM inversion. In both scenarios, the watermark is applied within a low-dimensional subspace (top right), where most of the watermark resides in the null space of Jø.: due its low dimensionality. The adversarial detection (bottom right) highlights the watermark's 's robustness, enabling the detector to retrieve the watermark even under adversarial attacks.
Low-rankness of the Jacobian Jo,)( As shown in Figure 2(a) of (34] the rank ratio for t E [0, consistently displays U-shaped pattern across various network architectures and datasets: (i) it is close near either the pure noise is low-rank (i.e., the numerical rank ratio is below 10-2) for all diffusion models within the range t E 0.77).
or the clean image 0. (ii) Jæ (x,)
Local linearity of the PMP fa:) As shown in 33 43), the mapping fa.) exhibits strong linearity across large portion of the timesteps, i.e., (a, + AAx) =s Lo [z \Aæ), a property that holds consistently true across different architectures trained on different datasets.
3 Watermarking by Shallow-Diffuse
This section introduces Shallow Diffuse, training-frre watermarking method designed for
Algorithm 1 Unconditional Shallow Diffuse
diffusion models. Building on the benign prop-
1: Inject watermark:
erties of PMP discussed in Section 2.2 we de-
2: Input: original image ah for the scenario (initial random seed ær for server scenario), watermark λλæ. embedding timestep t",
scribe how to inject and detect invisible wa- termarks in unconditional diffusion models in Section 3.1 and Section 3.2 respectively. Al- gorithm outlines the overall watermarking method for unconditional diffusion models. In Section 3.3 we generalize our approach to T2I diffusion models as shown in Figure
3: Output: watermarked image æb
4: if user scenario then
5: Zt.- DDIM Inv (mo,
6: else server scenario
7: Er. DDIM (wr,
8: end if
9: x a. AAx, x
DDIM (=
Embed watermark
3.1 Injecting Invisible Watermarks
11: Return: w
Consider an unconditional diffusion model (0 f) as introduced in Section 2.1 Instead of injecting the watermark Ax in the initial noise, we inject it in a particular timestep t" E [0,T] with
12:
13: Detect watermark:
14: Input: Attacked image #/ watermark AAn,
embedding timestep t",
15: Output: Distance score 7).
16: x +- DDIM Inv (xb W
(*)
x/
+ XAæ,
(3)
17: Detector (a AAz)
18: Return:
where E IR the watermarking strength,
DDIM Inv (æo, (*) under the user sce-
nario and ar. DDIM (ITT, under the server scenario. Based upon Section 2.2 we choose the timestep t" so that the Jacobian of the PMP (o,( Væz f0.(( is low-rank. Moreover, based

---

upon the linearity of PMP discussed in Section 2.2 we approximately have
)o
fo.((x XJ AJo.c(x(-)A
R00
(4)
(xt)
where the watermark A is designed to span the entire space R2 uniformly, a more detailed discussion on the pattern design of Aæ is provided in Section 3.2 The key intuition for Equation (4) hold is that, when rr- = rank Jo, (z+-) )) is low, significant proportion of AAæ lies in the null space of Jo. (xx)), so that Ja,, /- Am O.
Therefore, the selection of 1" is based on the requirement that fo.+(2;) ) is locally linear and that the rank of its Jacobian satisfies r? << d. practice, we choose t" 0.3I' based on results from the ablation study in Section 5.4 As result, the injection in Equation (4) preserves better consistency without changing the predicted æo. In the meanwhile, remains highly robust because any attack on Tp would remain disentangled from the watermark, so that xAæ remains detectable.
In practice employ the DDIM method instead of PMP for sampling high-quality images, but the above intuition still carries over to DDIM. From Equation (T). when we inject the watermark Ax into ax as given in Equation we know that
W - = (DIM
VT - 0
=
(zI-- + AAæ var- fo.
(5)
VI Ot-
where the approximation follows from Equation embedded into the DDIM sampling process entirely through the second term of Equation (5) and it decouples from the first term, which predicts øo. Therefore, similar to our analysis for PMP, the first term in Equation (5) maintains the consistency of data generation, whereas the difference in the second term, highlighted in blue, serves key feature for watermark detection, which we will discuss next. In Section we provide rigorous proofs validating the consistency and detectability of our approach.
This implies that the watermark AA is
3.2 Watermark Design and Detection
Second, building on the watermark injection method described in Section 3.1 we discuss the design of the watermark pattern and the techniques for effective detection.
Watermark pattern design. Building on the method proposed by 29 we inject the watermark in the frequency domain to enhance robustness against adversarial attacks. Specifically, we adapt this approach by defining a watermark xAr for the input a at timestep 1" as follows:
AA
DFT Inv (DFT (z,-) ) O (1 M) W C M) Zt.
where the Hadamard product @ denotes the element-wise multiplication. Additionally, we have the following for Equation 66:
Transformation into the frequency domain. Let DFT(.) and DFT - Inv(.) denote the forward and inverse Discrete Fourier Transform (DFT) operators, respectively. first apply DFT(-) to transform 2t- into the frequency domain, where the watermark is introduced via a mask. Finally, the modified input is transformed back into the pixel domain using DFT Inv(-).
shown Equation (6), we
The mask and key of watermarks. M the mask used to apply the watermark in the frequency domain, as shown in the top-left of Figure and W denotes the key of the watermark. Typically, the mask M circular, with the white area representing and the black area representing 0 in Figure 3 The mask is used to modify specific frequency bands of the image. Specifically, circular mask has a radius In the following, we discuss the design of and W detail.
In contrast to prior methods 22 31,, which design the mask M to modify the low-frequency components of the initial noise input, we construct M to target the high-frequency components of the image. While modifying low-frequency components effective due to the concentration of image energy in those bands, such approaches often introduce significant visual distortion when
5

---

frequeccy tegies
frequecy region
Mask M
W M
DFT w/o shift
DFT with shift
Figure 3: Visualization of Watermark Patterns. The left two images show the circular mask M and the key within the mask M @ W, where the key W consists of multiple rings and each sampled from the Gaussian distribution. The right two images illustrate the low- and high-frequency regions applying DFT, both before and after centering the zero frequency.
watermarks are embedded (see Figure [or illustration). In contrast, as shown in Figure our method introduces minimal distortion by operating on the high-frequency components, which correspond to finer details and inherently contain less energy. This effect is further amplified in our case, as we apply the perturbation to Z which is closer to the clean image To, rather than to the initial noise used [29 BT. To isolate the high-frequent components, we apply the DFT without shifting and centering the zero- pero-frequency component, as illustrated in the bottom- of Figure
In designing the key W, we follow [2)]. The key W is composed of multi-rings and each ring has the same value drawn from Gaussian distribution; see the top-right of Figure for an illustration. Further ablation studies on the choice M, W, and the effects of selecting low-frequency versus high-frrquency regions for watermarking can be found in Table
Watermark detection. During watermark detection, suppose we are given watermarked image 2h with certain corruptions, we apply DDIM Inversion to recover the watermarked image at timestep t", denoted z DDIM Inv (x) t). To detect the watermark, following [2 29 the Detector(-) in Algorithm computes the following p-value:
sum (M) [M @ W M O DFT (x)) 1E
M @ DFT
(z)) 11?
where sum() is the summation of all elements of the matrix. Ideally, if a watermarked image, 0. When z! is non-watermarked image, M @ W * M DFT (x)) and n O. By selecting a threshold no, non-watermarked images satisfy 1) foo- while watermarked images satisfy n < 7/0- The theoretical derivation of the p-value could be found in 227
M W= M @ DFT (x)") and
3.3 Extension Text-to-Image (T2I) Diffusion Models
So far, our discussion has focused exclusively on unconditional diffusion models. Next, we show how our approach can readily extended T2I diffusion models, which are widely used in practice. Specifically, Figure provides an overview of our method for T2I diffusion models, which can be flexibly applied both server and user scenarios:
Watermark injection. Shallow Diffuse embeds watermarks into the noise corrupted image x;, at a specific timestep 0.3T. the server scenario, given or ~ (N Ia) and prompt c, we calculate = CFG (IT, 1. c). In the user scenario, given the generated image Zp, we compute Ft-- = DDIM Inv (mo, 1", Ø), using an empty prompt Next, similar Section 3.1
we apply
DDIM to obtain the watermarked image x W DDIM (x W
Ø).
given watermarked image E with certain corruptions, we apply the DDIM Inversion to recover the watermarked image at timestep 1", denoted as a DDIM Inv (a 1", Ø). ) We detect the watermark Ar in # by calculating 7) in Equation 7 with detail explained in Section 3.2
Watermark detection. During watermark detection, suppose

---

Theoretical Justification
In this section, we provide theoretical justifications for the consistency and the detectability of Shallow Diffuse for unconditional diffusion models. We begin by making the following assumptions on the watermark and the diffusion process.
Assumption 1. Suppose the following holds for the PMP fo,( introduced in Equation !
Linearity: For any t and Aæ E $ we always have fo, =
L-Lipschitz continuous: we assume that (x) is L-Lipschiz continuous (|)o, S L, Vo
E [0,
should be noted that these assumptions are mild. The L-Lipschitz continuity is a common assumption for diffusion model analysis [9]. The approximated linearity have been shown in [34 with the assumption of data distribution to follow a mixture of low-rank Gaussians. For the ease of analysis, we assume exact linearity, but it can be generalized to the approximate linear case with extra perturbation analysis.
Now consider injecting watermark AAæ in Equation 3 where >> O is a scaling factor and Aæ is random vector uniformly distributed the unit hypersphere gd-1, i.e., Aar USS-11). Then the following hold for fe:(
Theorem 1 (Consistency of the watermarks). Suppose Assumption 7 holds and Ax U(S Define W. == fo, + >Aæ), Do,t == (x.) Then the E2-norm distance between wW and to.t is bounded by:
11 #0,1112 S ALM(re),
with probability at least 1 1-rē Here, h(r))
V
18 log (2r().
Theorem D guaarantees that injecting the watermark AAæ would only change the estimation by an amount of XLh(r:) with constant probability. where h(rz) only depends the rank of the Jacobian r, (re < d) rather than the ambient dimension d. Since T₁ is small, Equation (8) implies that the change in the prediction would be small. Given the relationship between PMP and DDIM in equation [ the consistency also applics to practical use. Moreover, in the following, we show that the injected watermark remains detectable based the second term in Equation (5).
Theorem 2 (Detectability of the watermark). Suppose Assumption 7 holds and A ~ U(S With a given in Equation (3). define = DDIM (x:" t - 1) and x. DDIM Inv (t).
The fz-norm distance between at. and x. can be bounded by:
| - x2112
-0w->xl1e2- S ALh(max((:-111 r.)l (as, ac-1) + (0u-1, (1 Lg (as, a(-1)) (9)
with probability at least 1 - rē -- Here, g(x,y) = -T- vl VI- Va, E (0,
VI-x
M((r)) V +
18 d-2 log (2rx).
Similarly, the term (( rr3) is small because only depends on the rank of the Jacobian rr or or-:-1 (f2-1, < d) rather than the ambient dimension d. Additionally, the term -g (ar, az-
g (a--1, a4) (1 Lg (a,, 04-1)) is also small number based on the design of ar for variance preserving (VP) noise scheduler [T]. Together, this implies that the difference between z: and x
small and x could be recovered by a! from one-step DDIM. Therefore, Theorem 2 implies that the injected watermark can be detected with high probability.
5 Experiments
In this section, we present comprehensive set of experiments to demonstrate the robustness and consistency of Shallow-Diflua across various datasets. We begin by highlighting its performance in terms of robustness and consistency in both the server scenario (Section and the user scenario (Section 5.2 We further explore the trade-off between robustness and consistency in Section 5.3
7

---

Table 1: Generation quality, consistency and watermark robustness under the server scenario. Bold indicates the best overall performance; Underline denotes the best among diffusion-bies methods.
Generation Quality
Generation Consisiency
Watermark Robusiness
Method
(TPR 1SFPR)
CLIP-Seore*
FID
PSNR
SSIM
LPIPS
Clean
Distortion
Regensration
Adversarial
Average
SD w/o WM
0.3069
25.56
DwtDet
0,3641
25.73
0.01
0.85
0.35
0.22
DwiDetSvd
0.3629
26.00
40.19
0.98
0.01
1.00
0.74
0.07
0.01
0.37
RivaGAN
0.3628
24.60
40.45
0.01
0.99
0.88
0.05
0.82
0.54
Stegustamp
0.3410
24.89
26.70
0.85
0.08
1,00
0.99
0.48
0.05
0.66
Stable Signature
0.3622
30.86
32.43
0.95
0.02
1,00
0.59
0.19
0.48
Tree-Ring Ring
0,3645
25.82
16.61
0.64
0.31
1,00
0.88
0.87
0.06
0.77
RingID
0.3637
27.13
14.27
0.51
0.42
1,00
1.00
1.00
0.33
0.91
Gaussian Shading
26.17
11.04
0.54
Shallow Diffuse
0.3669
25.60
35.49
0.96
0.02
1,00
1,00
0.98
0.54
0.93
Lastly, we provide extra multi-key identification experiments in Appendix C.2 and ablation studies
on watermark pattern design (Appendix C.3 watermarking embedded channel (Appendix C.4).
watermark injecting timestep (Section 5.4) and inference steps (Appendix C.5
Comparison baselines. For the server scenario, we select the following non-diffusion-bice
methods: DWiDet (23), Dwt [23]. RivaGAN [50], StegaStamp [51]; and diffusion-baaee
methods: Stable Signature (28), Tree-Ring Watermarks (29), RingID [3I, and Gaussian Shading
30. In the user scenario, we adopt the same baseline methods, except for Stable Signature, as this method are not suitable for this setting.
Evaluation datasets. We use Stable Diffusion 2-1-base 3 as the underlying model for our experi- ments, applying Shallow diffusion within its latent space. For the server scenario (Section 5.1). all diffusion-based methods are based on the same Stable Diffusion, with the original images 2%g gener- ated from identical initial seeds Tr. Non-diffusion methods are applied to these same original images 27 in a this scenario. For the user scenario (Section 5.2). we utilize the MS-COCO [52) and DiffusionDB datasets [53]. The first one is real-world dataset, while DiffusionDB is a collection model-generated images. From each dataset, we select 500 images for evaluation. For the remaining experiments in Section 5.3 and Appendix C we use the server scenario and sample 100 images for evaluation.
process. total of 5000 original images are generated for evaluation in
diffusion
Evaluation metrics. evaluate image consistency, we use peak signal-to-noise ratio (PSNR) 54 structural similarity index measure (SSIM) (55], and Learned Perceptual Image Patch Similarity (LPIPS) (56). comparing watermarked images their original counterparts. the server scenario, we also assess the generation quality of the watermarked images using Contrastive Language- Image Pretraining Score (CLIP-Score) (57) and Fréchet Inception Distance (FID) (58). To evaluate robustness, we plot the true positive rate (TPR) against the false positive rate (FPR) for the receiver operating characteristic (ROC) curve. We use the area under the curve (AUC) and TPR when FPR 0.01 (TPR @ 1% FPR) robustness metrics.
Attacks. Robustness is comprehensively evaluated both under clean conditions (no attacks) and with 15 types of attacks. Following [59], we categorized them into three groups, including: distor- tion attack (JPEG compression, Gaussian blurring, Gaussian noise, color jitter, resize and restore, random drop, median blurring), regeneration attack (diffusion purification [60] VAE-based image compression models 61
62) stable diffusion- based image regeneration
63 , times and times
rinsing regenerations [59] and adversarial attack (black-box and grey- grey-box averaging attack (64)). Here, we report only the TPR at 1% FPR for the average robustness across each group and all attacks. Detailed settings and full experiment results of these attacks are provided in Appendix C.I
5.1 Server Scenario Consistency and Robustness
Table T compares the performance of Shallow Diffuse with other methods in the server scenario. For reference, also apply stable diffusion to generate images from the same random seeds,

---

Table 2: Generation consistency and watermark robustness under the user scenario. Bold indicates the best overall performance; Underline denotes the best among diffusion- methods.
Watermark Rohusmess
Generation Comsitencyy
Method
(AUC 7IPR 1SPPRT)
PSNR SSIM
LPIPS
Regencation
Adversaaal
Avenaee
DwtlXt
37.88
0.97
0.83
0.34
0.00
0.82
0.36
DwiDetSvd
38.06
0.98
0.02
1.00
0.76
0.06
0.00
0.38
COCO
RivaGAN
40.57
0.98
0.04
1,00
0.93
0.05
1,00
0.59
Stegastamp
Caussian Shading
10.17
0.23
0.65
1.00
0.99
1,00
0.47
0.92
Tree- Ring
28.22
0.57
0.41
1.00
0.90
0.95
0.31
0.84
RingID
12.21
0.38
0.58
1,00
0.98
1,00
0.79
0.96
32.11
1.00
1.00
DiElusioDD
DwtlXt
37.77
0.96
0.02
0..76
0.34
0.01
0.78
0.27
DwiDetSdd
37.84
0.97
0.02
1.000
0.74
01.04
0.00
0.36
Stegastamp
32,03
0.85
0.08
1,00
0.96
0:46
0.26
0.67
Gaussian Shading
10.61
0.27
0.63
1.00
0.99
1,00
0.46
0.92
Tree- Ring
28.3
0.62
0.29
1,00
0.81
0.87
0.26
0.76
1.00
Shallow Diffuse
33.07
0.89
0.03
1.00
1,00
0.93
0.59
0.92
without adding watermarks (referred to as "SD w/o WM" in Table D. terms of generation quality, Shallow Diffuse achieves the best FID and CLIP scores among all diffusion-based methods. It also demonstrates superior generation consistency, achieving the highest PSNR, SSIM, and LPIPS scores. Regarding robustness, Shallow Diffuse performs comparably Gaussian Shading and RinglD, while outperforming the remaining methods. Although Gaussian Shading and RingID show similar levels of generation quality and robustness in the server scenario, their poor consistency makes them less suitable for the user scenario.
5.2 User Scenario Consistency and Robustness
Under the user scenario, Table 2 presents a comparison of Shallow Diffuse against other meth- ods. In terms of consistency, Shallow Diffuse outperforms all other diffusion-based approaches. To measure the upper bound of diffusion-based methods, we apply stable diffusion with 2o = DDIM(DDIM Inv (20, Ø), O, Ø) and measure the data consistency between to and æo (denoted in SD w/o WM in Table 2). The upper bound is constrained by eтгоrs introduced through DDIM inversion, and Shallow Diffuse comes the closest to reaching this limit. For non-diffusion-bace methods, which are not affected by DDIM inversion eπrоrs, better image consistency is achievable. However, visualized in Figure Shallow Diffuse also demonstrates strong generation consistency, In terms of robustness, Shallow Diffuse performs comparably to RingID and Gaussian shading, while outperforming all other methods across both datasets. Notably, RinglI> and Gaussian achieve high robustness at the sacrifice of poor generation consistency (see Table 2 and Figure 4 In contrast, Shallow Diffuse is the only method that balances strong generation consistency with high watermark robustness, making it suitable for both user and server scenarios.
5.3 Trade-off between Consistency and Robustness
Figure bottom illustrates the trade-off between consistency and robustness for Shallow Diffuse and other baselines. As the radius of M increases, the watermark intensity also increases, reducing image consistency but improving robustness. By adjusting the radius of M, plot the trade-off using PSNR, SSIM, and LPIPS against TPR @ FFPR. From Figure [ bottom, curve Shallow Diffuse is consistently above the curve of Tree-Rine Ring Watermarks and RingID, demonstrating Shallow Diffuse's better consistency at the same level robustness.
5.4 Ablation Study over Injecting Timesteps.
Figure shows the relationship between the watermark injection timestep and both consistency and robustness Shallow Diffuse achieves optimal consistency at t 0.27 and optimal robustness
In this experiment, we evaluate robustness against distortion attacks.
"In this experiment, we do not incorporate additional techniques like channel averaging or enhanced watermark patterns. Therefore, when = L.02', the method is equivalent Tree- Rine-Ring.

---

COCO Dilleienaa
Original Image
DwiDetvv
Stogssamp
Stable Signature
Ring
Gousian Stading
RingID
Shalow Difluse (cun)
Figure 4: Generation consistency under user scenarios. We compare the visualization quality of our method against DwtDet, DwtdetSvd, RivaGAN, Stegastamp, Stable Signature, Tree Ring, Gaussian Shading, and RingID across the DiffusionDB, and COCO datasets.
PSNRT
35.00
0.97
Accuracy"
0.96
SSIM1
0.50
0.95
TPR 1SFRRR
LPIPS
0.30
0.89
0.20
0.83
07
0.27
0.47
0.67
0.87
107
07"
0.27
0.47
0.67
0.87
1.57
(a) Consistency
(h) Robustness
Figure 5: Ablation study at different timestep t. We evaluate the consistency and robustness under user scenarios when watermarks are injected at varying timesteps.
at = 0.37. In practice, select 0.3T. This result aligns with the intuitive idea proposed in Section 3.1 and the theoretical analysis in Section 4 low-dimensionality enhances both data generation consistency and watermark detection robustness. However. according to (34), the optimal timestep rx for minimizing yx satisfies L" E [0.57, 0.7T). We believe the best consistency and achieved at 1* due the error introduced by DDIM Inv. As increases, this еиrоr grows, leading to a decline in both consistency and robustness. Therefore, the best tradeoff reached at [0.27', 0.3T",, where (æ; remains low-rank but É still below t², Another possible explanation is the gap between the image space and latent space in diffusson models. The rank curve 33 is evaluated for an image-space diffusion model, whereas Shallow Diffuse operates in the latent-space diffusion model (e.g., Stable Diffusion).
robustness
Conclusion
proposed Shallow Diffuse, a novel and flexible watermarking technique that operates seamlessly in both server-side and user-side scenarios. By decoupling the watermark from the sampling process, Shallow Diffuse achieves enhanced robustness and greater consistency. Our theoretical analysis demonstrates both the consistency and detectability of the watermarks. Extensive experiments further validate the superiority of Shallow Diffuse over existing approaches.
7 Acknowledgement
We acknowledge funding support from NSF CCF-2212066. NSF CCF-2212326, NSF IIS 2402950, ONR 1200192212339, DARPA HR0011578254, and Google Research Scholar Award.
10

---

References
[1] Jonathan Ho, Ajay Jain, and Picter Ahbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840-660 6851, 2020.
[2] Yang Song, Jascha Sih--Dickttein, Diederik Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poolc. Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations, 2021.
[3] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684-10695, 2022.
[4] Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, et al. Scaling rectified flow transformers for high-resolution image synthesis. In Forty-first International Conference on Machine Learning, 2024.
[5] Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text-conditional image generation with clip latents. arXiv preprint arXiv:2204.06125. 1(2)3, 2022.
[6] James Betker, Gabriel Goh, Li Jing. Tim Brooks, Jianfeng Wang. Linjie Li, Long Ouyang, Juntang Zhuang, Joyce Lee, Yufci Guo, et al. Improving image generation with better captions. Computer Science. https://cdn. openai. com/papers/dall--33 pdf. 2(3):8, 2023.
[7] Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L. Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, al. Photorealistic text-to- image diffusion models with deep language understanding. Advances in neural information processing systems, 1--36679-34999 2022.
[8] Zach Evans, Julian D Parker, CJ Carr, Zack Zukowski, Josiah Taylor, and Jordi Pons. Long-form music generation with latent diffusion. arXiv preprint arXiv:2404. 10301, 2024.
[9] Tim Brooks, Bill Peebles, Connor Holmes, Will DePue, Yufei Guo, Li Jing, David Schnurr, Joe Taylor, Troy Luhman, Eric Luhman, Clarence Ng. Ricky Wang, and Aditya Ramesh. Video generation models as world simulators. 2024.
[10] Rowan Zellers, Ari Holtzman, Hannah Rashkin, Yonatan Bisk. Ali Farhadi, Franziska Roesner, and Yejin Choi. Defending against neural fake news. Advances in neural information processing systems, 32, 2019.
[11] Josh A Goldstein, Girish Sastry, Micah Musser, Renee DiResta, Matthew Gentzel, and Katerina Se- dova. Generative language models and automated influence operations: Emerging threats and potential mitigations. arXiv preprint arXivv2301.04220 2023.
[12] Miles Brundage, Shahar Avin, Jack Clark, Helen Toner, Peter Eckersley, Ben Garfinkel, Allan Dafoe, Paul Scharre, Thomas Zeitzoff, Bobby Filar, et al. The malicious use of artificial intelligence: Forecasting, prevention, and mitigation. arXiv preprint orXiv:8802.0722 2018.
[13] Xiangming Gu, Chao Du, Tianyu Pang. Chongxuan Li, Min Lin, and Ye Wang. On memorization in diffusion models. arXiv preprint 230.:22300002644 2023.
[14] Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Diffusion art or digital forgery? investigating data replication in diffusion models. In Proceedings of the IEFF/CVF Conference on Computer Vision and Patiern Recognition, pages 6048-6058, 2023.
[15] Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Understanding and mitigating copying in diffusion models. In Thirty-seventt Conference on Neural Information Processing Systems, 2023.
[16] Yuxin Wen, Yuchen Liu, Chen Chen, and Lingjuan Lyu. Detecting, explaining, and mitigating memorization in diffusion models. In The Twelfih International Conference on Learning Representations, 2023.
[17] Benjamin J Zhang, Siting Liu, Wuchen Li, Markos Katsoulakis, and Stanley Osher. Wasserstein proximal operators describe score-based generative models and resolve memorization. arXiv preprint arXiv:2402.06162 2024.
[18] Shi Fu, Sen Zhang, Yingjie Wang, Xinmei Tian, and Dacheng Tao. Towards theoretical understandings of self-conssming generative models. In Forty-first International Conference on Machine Learning, 2024.
11

---

[19] Sina Alemohammad, Josue Casco- Lorenzo Luzi. Ahmed Imtiaz Humayun, Hossein Babaei. Daniel LeJeune, Ali Siahkoohi, and Richard Baraniuk. Sell-consuming generative models go MAD. In The Twelfth International Conference on Learning Representations. 2024.
[20] Elvis Dohmatob, Yunzhen Feng, Pu Yang. Francois Charton, and Julia Kempe. tale of tails: Model collapse as a change scaling laws. Forty-first International Conference on Machine Learning, 2024.
[21] Ilia Shumailov, Zakhar Shumaylov, Yiren Zhao, Nicolas Papernot, Ross Anderson, and Yarin Gal. Ai models collapse when trained on recursively generated data. Nature, 63 631(8222)7555-75, 2024.
[22] Elizabeth Gibney, Ai models fed ai-generteed data quickly spew nonsense. Nature, 632(8023):188 19, 2024.
[23] Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker. Digital watermarking and steganogrupky. Morgan kaufmann, 2007.
[24] Vassilios Solachidis and Loannis Pitas. Circularly symmetric watermark embedding in 2-d dft domain. IEEE transactions on image processing, 10 10111):741-1753, 2001.
[25] Chin-Chen Chang, Piyu Tsai, and Chia- Chenn Lin. Svd-based digital image watermarking scheme. Pattern Recognition Letters, 26( (011000:577-11
2005.
[26] Junxiu Liu, Jiadong Huang, Yuling Luo, Lvehen Cao, Su Yang, Duqu Wei, and Ronglong Zhou. An optimized image watermarking method hased on and svd in dwt domain. IEEE Access, 7:80849-80860, 2019.
[27] Lijun Zhang, Xiao Liu, Antoni Viros Martin, Cindy Xiong Bearfield, Yuriy Brun, and Hui Guan. Robust image watermarking using stable diffusion, 2024.
[28] Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEF/CVF International Conference on Computer Vision, pages 12466-22477 2023.
[29] Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings watermarks: Invisible fingerprints for diffusion images. Thirty-seventhh Conference on Neural Information Processing Systems, 2023.
[30] Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shading: Provable performance-losse image watermarking for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12162-12171, 2024.
[31] Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification. arXiv preprint arXiv:2404.1444 14055. 2024.
[32] Huayang Huang, Yu Wu, and Qian Wang. ROBIN: Robust and invisible watermarks for diffusion models with adversarial optimization. In The eighth Annual Conference on Neural Information Processing Systems, 2024.
[33] Peng Wang, Huijie Zhang, Zekai Zhang, Siyi Chen, Ma, and Qing Qu. Diffusion models learn low-dimensional distributions via subspace clustering. arXiv preprint arXiv:2409.02426, 2024.
[34] Siyi Chen, Huijic Zhang, Minzhe Guo, Yifu Lu, Peng Wang. and Qing Qu. Exploring dineeninniioal subspaces in diffusion models for controllable image editing. In Thirty-eighth Annual Conference on Neural Information Processing Systems (NeurIPS2024), 2024.
[35] Tero Karras, Miika Aittala. Timo Aila, and Samuli Laine. Elucidating the design space of diffusion-based generative models. Advances in Neural Information Processing Systems, 35:26565-26577 2022.
[36] Jiaming Song, Chentin Meng, and Stefano Ermon. Denoising diffusion implicit models. In International Conference on Learning Representations, 2021.
[37] Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm-solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps. Advances in Neural Information Processing Systems, 35:5775-5787, 2022.
[38] Huijie Zhang, Jinfan Zhou, Yifu Lu, Minzhe Guo, Peng Wang. Liyue Shen, and Qing Qu. The emergence of reproducibility and consistency in diffusion models. In Forty-first International Conference on Machine Learning, 2024.
12

---

[39] Calvin Luo. Understanding diffusion models: A unified perspective. arXiv preprint arXiv:2208. 2022.
[40] Jonathan Ho and Tim Salimans. Classifier free diffusion guidance. arXiv preprint arXiv:2207112598 2022.
[41] Hila Manor and Tomer Michaeli. Zero-shot unsupervised and text-based audio editing using DDPM inversion. Ruslan Salakhutdinov, Zico Kolter, Katherine Heller, Adrian Weller, Nuria Oliver, Jonathan Scarlett, and Felix Berkenkamp, editors, Proceedings of the 41st International Conference on Machine Learning, volume 235 of Proceedings of Machine Learning Research, pages Jul 2024.
PMLR, 21-27
[42] Hila Manor and Tomer Michaeli. On the posterior distribution in denoising: Application to uncertainty quantification. In The Twelfih International Conference Learning Representations. 2024.
[43] Xiang Li, Yixiang Dai, and Qing Qu. Understanding generalizability of diftusion models requires rethinking the hidden gaussian structure. Advances neural information processing systems, 37:57499 57538, 2024.
[44] Adam Block, Youssef Mrouch, and Alexander Rakhlin. Generative modcling with denoising auto-encoders and langevin sampling. arXiv preprint arXiv:2002.001007 2020.
[45] Holden Lee, Jianfeng Lu, and Yixin Tan. Convergence for score- based generative modeling with polynomial complexity. Advances in Neural Information Processing Systems, 35:22870-22882, 2022.
[46] Sitan Chen, Sinho Chewi, Jerry Li, Yuanzhi Li, Adil Salim, and Anru Zhang. Sampling is as easy as learning the score: theory for diffusion models with minimal data assumptions. In The Eleventh International Conference on Learning Representations, 2023.
[47] Hongrui Chen, Holden Lee, and Jianfeng Lu. Improved analysis of score-based generative modeling: User-friendly bounds under minimal smoothness assumptions. In International Conference on Machine Learning, pages 4735-4763. PMLR, 2023.
[48] Zhenyu Zhu, Francesco Locatello, and Volkan Cevher. Sample complexity bounds for score-matching: Causal discovery and generative modeling. Advances Nearal Information Processing Systems, 36:3325- 3337, 2023.
[49] Minshuo Chen, Kaixuan Huang, Tuo Zhao, and Mengdi Wang. Score approximation, estimation and distribution recovery of diffussin models on low-dimensional data. In International Conference on Machine Learning, pages 1672-4712 PMLR. 2023.
[50] Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. arXiv preprint 1909.019990128: 2019.
[51] Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical photographs. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 21 17-2126. 2020.
[52] Tsung- Vi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C. Lawrence Zitnick. Microsoft coco: Common objects context. In Computer Vision-ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pages 740-755. Springer, 2014.
[53] Zijie J. Wang, Evan Montoya, David Munechika, Haoyang Yang, Benjamin Hoover, and Duen Horng Chau. Large-scale prompt gallery dataset for text-to-image generative models. 10X1:2220.114896 [cs), 2022.
[54] Bernd Jähne. Digital image processing. Springer Science & Business Media, 2005.
[55] Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE Transactions on Image Processing, 13(4):600-612, 2004.
[56] Richard Zhang, Phillip Isola, Alexci A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness deep features a perceptual metrie. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 386-595, 2018
[57] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pages 8748 8763. PMLR, 2021.
13

---

[58] Martin Heusel. Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by time-scale update rule converge a local nash equilibrium. Advances neural information processing systems, 30, 2017.
[59] Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu. Chenghao Deng. Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, and Furong Huang. Benchmarking the robustness of image watermarks, 2024.
[60] Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. In International Conference on Machine Learning (ICML), 2022.
[61] Zhengxue Cheng, Heming Sun, Masaru Takeuchi, and Jiro Katto. Learned image compression with discretized gaussian mixture likelihoods and attention modules. In Proceedingy of the IEEE/CVF conference on computer vision and pattern recognition, pages 7939-7944 2020.
[62] Johannes Ballé, David Minnen, Saurabh Singh, Sung Jin Hwang, and Nick Johnston. Variational image compression with a scale hyperprior. In International Conference on Learning Representations, 2018.
[63] Xuandong Zhao, Kexun Zhang. Yu-Xiang Wang, and Lei Li. Generative autoencoders as watermark attackers: Analyses of vulnerabilities and threats. 2023,
[64] Pei Yang, Hai Ci, Yiren Song, and Mike Zheng Shou. Can simple averaging defeat modern watermarks? Advancex in Neural Information Processing Systems, 37:56644- 56673, 2024.
[65] Ali Al-Haj. Combined dwt-det digital image watermarking. Journal of computer science, 3(9):740-746, 2007.
[66] KA Navas, Mathews Cheriyan Ajay. M Lekshmi, Tampy S Archana, and Sasikumar. Dwt-det-svd based watermarking, In 2008 3rd international conference on communication systems software and middleware and workshops (COMSWARE' 08), pages 271 271-274. IEEE, 2008.
[67] Mahdi Ahmadi, Alireza Norouzi. Nader Karimi, Shadrokh Samavi, and Ali Emami. Redmark: Framework for residual diffusion watermarking based on deep networks. Expert Systems with Applications, 146: 13157, 2020.
[68] Jac- Bun Lee, Young-Ho Ho Sco, and Dong- Wook Kim. Convolutional neural network- digital image watermarking adaptive to the resolution of image and watermark. Applied Sciences, 10(19):6854, 2020.
[69] Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In European Conference on Computer Vision, 2018
[70] Gabriel Ganii, Brendan Leigh Ross, Rasa Hosseinzadeh, Anthony L. Caterini. and Jesse C. Cresswell. Deep generative models through the lens of the manifold hypothesis: survey and new connections. Transactions on Machine Learning Research, 2024. Survey Certification, Expert Certification.
[71] Jan Pawel Stanczuk, Georgios Batzolis, Teo Deveney, and Carola-Bibiane Schönlieb. Diffusion models encode the intrinsic dimension of data manifolds. In Forty-first International Conference on Machine Learning, 2024.
[72] Hamidreza Kamkari, Brendan Leigh Ross, Rasa Hosseinzadeh, Jesse C Cresswell, and Gabriel Loaiza- Ganem. A geometric view of data complcxity: Efficient local intrinsic dimension estimation with diffusion models. In Thirty-eighth Annual Conference on Neural Information Processing Systems (NeurIPS2024), 2024.
[73] Black Forest Labs. Flux. htttps:://gsthuu..mmmmllaaaae
2024.
[74] Sandu Popescu, Anthony J Short, and Andreas Winter. Entanglement and the foundations of statistical mechanics. Nature Physics, 2(11):754 1188, 2006.
14

---

A Impact Statement
In this work, we introduce Shallow Diffuse, a training-free watermarking technique that hides a high-frequency signal in the low-dimensional latent subspaces of diffusion models, enabling invisible yet reliably detectable attribution for both server-side text-to-image generation and user-side post- processing. As synthetic and authentic images flooding the internet, establishing verifiable provenance is essential for copyright protection, misinformation mitigation, and scientific reproducibility. Our method preserves perceptual quality, withstands wide range of image attacks, and requires no model retraining, making it practical for deployment. We further provide thcoretical guarantees on imperceptibility and watermark recoverability, grounded in the low-rank structure of the diffusion latent space. We believe our work contributes to the development of trustworthy generative models and can inform future standards for media authentication, digital content tracking, and responsible Al deployment. While our technique could potentially be repurposed for covert signaling, we emphasize that our goal is to enhance transparency and accountability in generative AI. We encourage responsible use of this research in line with ethical guidelines and broader societal interests.
B Related Work
B.1 Image Watermarking
Image watermarking has long been a crucial method for protecting intellectual property in computer vision (6). Traditional techniques primarily focus on user-side watermarking, where watermarks are embedded into images post-generation. These methods 65 66 typically operate in the frequency domain to ensure the watermarks are imperceptible. However, such watermarks remain vulnerable to adversarial attacks and can become undetectable after applying simple image manipulations like blurring.
leveraged neural networks to embed watermarks. While these methods improved robustness and imperceptibility. they often suffer from high computational costs during fine-tuning and lack flexibility. Each new watermark requires additional fine-tuning or retraining, limiting their practicality.
Early deep learning-base -based approaches to watermarking 27 2
67
69
More recently, diffusion model-based watermarking techniques have gained attraction due to their ability to seamlessly integrate watermarks during the generative process without incurring extra computational costs. Techniques such 31 embed watermarks directly into the initial noise and retrieve the watermark by reversing the diffusion process. These methods enhance robustness and invisibility but are typically restricted to server-side watermarking, requiring access to the initial random seed. Moreover, the watermarks introduced by [29]
[29]31] 31 significantly alter the data distribution, leading to variance towards watermarks in generated outputs (as shown in Figure D.. Recent work 32 proposes embedding the watermark at an intermediate time step using adversarial optimization.
In contrast to 29 31, our proposed shallow diffuse disentangles the watermark embedding from the generation process by leveraging the high- gigh-dimensional null space. This approach significantly improves watermark consistency while maintaining robustness. Furthermore, unlike [32), which employs adversarial optimization, our method is entirely training- free. Additionally, we provide both empirical and theoretical validation for the choice of the intermediate time step. To the best of our knowledge, this the first training-fre free method that supports watermark embedding for both server-side and user-side applications while maintaining high robustness and consistency.
B.2 Low-dimensional Subspace in Diffusion Model
In recent years, there has been growing interest in understanding deep generative models through the lens of the manifold hypothesis [70]. This hypothesis suggests that high-dimensional real- world data actually lies in latent manifolds with low intrinsic dimension. Focusing on diffusion models, [7 empirically and theoretically shows that the approximated score function (the gradient of the log density of corruped data distribution) in diffusion models is orthogonal to low-dimensional subspace. Building on this, 33 34
find that the estimated posterior mean from diffusion models lies within this low-dimensional space. Additionally, [4 discovers strong local linearity within the space, suggesting that can be locally approximated by linear subspace. This observation motivates our Assumption I where assume the estimated posterior mean lies in low- dinenimensional subspace.
15

---

Building upon these findings, 77 72 introduce local intrinsic dimension estimator, while [70] proposes a method for detecting out-of-domain data. [33] offers theoretical insights into how diffusion model training transitions from memorization to generalization, and [34 41 explores the semantic basis of the subspace achieve disentangled image editing. Unlike these previous works, our approach leverages the low-dimensional subspace for watermarking, where both empirical and theoretical evidence demonstrates that this subspace enhances robustness and consistency.
C
Additional Experiments
C.1 Details about Attacks
In this work, we intensively tested our method on four different watermarking attacks, both in the server scenario and in the user scenario. These watermarking attacks can be categorized into three groups, including:
Distortion attack
JPEG compression (IPEG) with a compression rate of 25%.
Gaussian blurring (G.Blur) with an 8 x 8 filter size.
Gaussian noise (G.Noise) with o = 0.1.
Color jitter (CJ) with brightness factor uniformly ranges between 0 and 6.
Resize and restore (RR). Resize to 50% of pixels and restore to original size.
Random drop (RD). Random drop square with 40% of pixels.
Median blurring (M.Blur) with 7 x median filter.
Regeneration attack
Diffusion purification 60 (DiffPure) with the purified step at 0.3T.
VAE-based image compression 61 (ICI) and [62 (IC2), with a quality level of 3.
Diffusion-basee image regeneration (IR) 66
Rinsing regenerations (59) with 2 times (Rinse2x) and 4 times (Rinse4x).
Adversarial attack
Blackbox averaging (BA) and greybox averaging (GA) watermarking removal attack (4]
Visualizations of these attacks are in Figure Detailed experiments for Table I (Table 2 on the above
attacks are reported by groups, with the distortion attack Table (Table and the regeneration and adversarial attacks in Table (Table
(a) Clean
(b) JPEG
(c) G.Blur
(d) G.Noise
(c) CJ
i RR
(g) RD
(h) M.Blur
(i) DiffPure
(j) IC1
(k) IC2
()) IR
(m) Rinse2x (n) Rinse4x
Figure 6: Visualization of different attacks.
C.2 Multi-key Watermarking
In this section, we examine the capability of Shallow Diffuse to support multi-key watermarking. We evaluate the ability to embed multiple watermarks into the same image and detect each one independently. For this experiment, uses unique ring-shaped key W, and non-overlapped mask M (part of a circle). This non- trivial setting could pre-defined the key number and non-overlapped mask M for application.
test cases with 2, 4, 8, 16, 32 watermarks. Each watermark
16

---

Table 3: Watermarking Robustness for distortion attacks under the server scenario.
Watermarking Robusiness (AUC
Method
JPRG
G.Noise
M.Blur
Distortion Average
DwiLkt
0.97A085
0,47/0.00
0.5122002
0,96/0.78
0.5350115
0.6600
0.99/0.88
0.58/0.01
0.71X1.35
DwilDesSed
1,0011000
0.6400.10
0.9600.70
0.99/0.99
0.53/011
0.99/0.99
1,0011000
1,001.000
0,89/1.44
RivGGAN
1.000.99
0.9480.9
0.96/0.76
0.97/0.88
0,950.79
0.99/098
0.99/0.98
0.99/0.97
0.97/0088
Stegastamp
1.001.00
1.001100
1,000.95
0,98/0997
1.0000.97
1,00/.00
1,001.000
1,001.000
1,0000.99
Signature
L.001000
0.99/1.76
0.57/0000
0.71/0.14
0,96/0887
1,00/1000
0.95/0.62
0,89/159
Tree-Ring Watermarks
1.001.00
0.99/0.97
0.98/0.98
0,94/0.50
0.96/0.67
1.00/1.00
0.99/0.97
0.99/0.94
0,98/0.88
Ringl[>
1.00/1000
1.000/100
1.00/1.00
1.000099
0.99/0988
1.00/1.00
1,00/1000
1,001.000
1.00/1.00
Gaussian Shading
1.0011000
1.00/1000
1,00/1.000
1,00/1000
1.00/1000
1.00/1.00
1,00/1.00
1,001.00
1,00/1,00
Shallow Diffase (ours)
1.00/1.00
1,00/1000
1,00/1000
1,00/1.00
1,00/1.00
1,00/1000
1.00/1000
1,00/1000
1,00/1100
Table 4: Watermarking Robustness for regeneration and adversarial attacks under the server
scenario.
Method
TC
TCA
1K
Wutemmrkiigg Kobustness (AUL MIFRO INEPPR]
KinGzes
Kinspai
Hegenennion Average
BA
GA
Advessmnl Neenaee
DuiLeT
1.5270.01
0.4900110
0,77A1224
12
U.9501.44
DeDDeSed
0.510.02
0.73AL.03
0.682.04
0.700007
0.76A1.18
0.760.10
0.704D.07
D36/002
0.17A1.0
0.52/001
RovaGAN
0.730-16
0.650.08
0.633.04
0.568..00
0.540).11
0.588402
0.630005
0.968164
1.000
09770.82
Sizpstamp
09180.29
L0000.97
10000.90
0.900.43
0.754).13
0.620006
0.850048
D633003
0.6801.66
06660.05
Stable Signatre
0348001
0.930.38
09180.00
0668002
0.510.11
0.53001
L009U9K
1,001.00
LAWE999
Tre Ringg Winemorks
0.96077
0.990..97
0. 09900.9
0.590.9 92
0
0.968775
0990067
0.169.08
0.05/0.5
1
Ringlf>
LAV1000
1,001.000
LOVE.00
180/1000
1.01.000
10000.00
LOWEL00
0.448135
0.400.31
04220.3 33
Canisia Shuding
LAV1000
1,00/1000
LAVE.00
L00/100
1001.00
LOWLO00
LOW/L.00
0.538048
0.53/147
0.530.47
Shallow Dilfuse
LA00000
1,000,000
LOWT,00
1000.99
1001000
(1990090
10000.9
0.37845
0,700.55
Table 5: Watermarking Robustness for distortion attacks under the user scenario.
Watermarking Robustness (AUC (IPPRTTTFPRT)
[PPP
Method
JPEG
G.Naise
RR
M.Blur
Average
COCO Dataset
DwiDet
0.98/7.83
0.50/0.01
0.50V0.00
0.9770.81
0.54A0.14 14
0.67A0.17
0.99/0.93
0.59/8.05
0.64/0.54
DwiDeiSvd
1.001.000
0.64/0.13
0.98/0.83
0.99/1.99
0,54/1.13
1.00/1000
1.00/1.00
1.00/1.00
0.89/0.76
RivaGIN
1.001,00
0,97/0086
0.98/0.86
0.99/0.94
0.96/0.82
1.0011000
1.00/1.00
1.00/1.00
0.99X0.93
Stegastamp
L.0/1.00
1,0/1.00
0.99/0.90
0.9000.87
1.009.98
1.0000.9
1.00/0.99
1.00/1.00
0.99X0.97
Tree-Ring Watermarks
L00/1.00
0.99/0.87
0.99/0.86
1,00/1000
0.88/0.99
1.00/1.00
1.00/1.00
1,00/1000
0 90
RingID
L00/1.00
100/1.00
1,00/1000
0.98/0.86
1.000.99
1.00/1,00
1.00/1.00
1.00/1.00
1.00/0.98
Gaussian Shading
1.0/1.000
1,00/1000
1.00/1.00
1.0/1.00
1,000095
1,00/1.00
1.00/1.00
1.00/1.00
1,00N0.99
SShallo Dilluse (ours)
L00/1.00
L00/1.00
1,007.000
L.001.000
1.00/.99
1,00/1.00
L.00/.00
10001.000
LOWLO0
DiffusionDB Datasel
DwiDet
0.960076
0.51/0.018
O. 0.9600.7
0.5 15
0,99/0.88
DwiDetSvd
1,0011000
0.6420. 10
0.96/0.70
0. 0.99X199
0,53X1.12
1.00/1.00
1.00/1000
100/1.00
0.89/0.74
RivaGAN
0,94/0.69
0.96/0.76
0.9770.88
0,95/0,79
1.000098
0.99/0.98
100/1.00
Stegastamp
1.00/1.00
100/1000
0.99/0.88
0.91/1.89
L.00X199
1.0000997
1.00/1.00
1.0000.96
0.99X0.96
Tree: Ring Watermarks
L00/1.00
0.99/0688
0.94/0.62
0,84X0.
1.00/1.00
RinglD
1.001100
1.00/1.00
L.001.00
0.9%//.S6
1.00X1998
1.00/1.00
1.00/1000
1.00/1000
1.0000.95 98
Gaussian Shading
1.0/1.00
1.00/1.00
1.001.000
0.99/0.96
1.00/1.00
1.00/1.00
1.00/1000
Shallow Dilfuse (ours)
1,001,00
L.0INU999
L0000.99
L.001,000
L,M0/.000
L0001.00
L00/1.00
LO0F0.00
L.WF0.00
Table 6: Watermarking Robustness for regeneration and adversarial attacks under the user
scenario.
Watermarinng Robusiness (AUC IITK TAPPPR
IC1
KinszAs
KinspAx
Regenenzionn Average
BA
GA
Adversinal Aperage
COCO Dataset
Duill
1:4001000
0.400.00
11460000
0BS000
0.060.34
DaiDesSed
0.00001
0,704105
0.6420044
0.68/007
0.7230.88
0.690008
0.6600.55
0.79/000
0.49/1.00
0.66/0.00
RivCAN
0630002
0.681005
0.660.04
0.580.15
0.2540.44
0680003
0.690.05
L801100
1,89/1000
1,010000
Siegadump
0814122
1.000.5
1000005
0.360 26
0.28/0.2
0.90011 16
0.850047
0.730.2
0.71/025
0. 0.72K.00 26
Tree Ring Watommarks
L,90300
L301300
0U90375
0.201122
RingiD
LAW1000
1.0/0000
1001.00
1001.00
1.01000
LOW100
LOW1.00
0.550.59
1.001.00
0.380.79
Gaussian Shading
LA01.00
1.0/0000
1001.00
180/100
1.01.00
10W1000
1001.00
0.330.45
0.5200.4
0.330047
Shallow 1i2luse
1098036
100009
1300
11 1ANDUG
0L700122
DiffusioDB Dataset
DwIDXI
03000000
0.20001
0.3900.00
0300020
0350201
U.9000.77
0918L75
DwiDeiSe
0.514.02
0.7341.03
0500009
0660002
0.6700.14
B.770000
0.30/1.0
0.580.00
RivaGAN
0.560.00
0.658003
0.630.044
0633001
0.6530114
LOWCUU
1.0011.99
100V9.00 98
03830
1.000191
10000.93
0350000
0680011
0.8600-66
21
0.7101.30
0.7000.24
Tra--Ring Witemmerks
0.9900199
0.900.0
0.38/1131
0.35003
Ringlt>
LAW/100
L001000
1,0/1000
1.007.00
1.000.9
0.710L58 58
1.00/1.00
0 79
Shuding
1000.99
1.000159
L0011.00
1/0010 160
1,081.00
LOV1000
LOIV1000
0.5000.44
Dilfuse
0.988888
17

---

Original Image
StageStamp
Shallow Diffuse (ours)
Figure 7: Generation Consistency in server scenarios. We compare the visualization quality of our method against the original image and StageStamp.
The metric for this task the average robustness across all keys, measured in terms of AUC and TPR @1 1.FP.. For this study, we test the Tree-Ring and Shallow Diffuse in the server scenario.
The results of this experiment are presented in Table Shallow Diffuse consistently outperformed Tree-Ring in robustness across different numbers of users. Even the number of users increased to 32, Shallow Diffuse maintained strong robustness under clean conditions. However, in adversarial settings, its robustness began to decline when the number of users exceeded 16. Under the current setup, when the number of users surpasses the predefined limit, our method becomes less robust and accurate. We believe that enabling watermarking for hundreds even thousands of users simultancously is challenging yet promising future direction for Shallow Diffuse.
Table 7: Multi-key re-watermark for different attacks under the server scenario.
Wassmook rambiie
Medhed
JPBC
C.B2
Waummrkir Rcheenee (ALC
XX
K17
DRIParE
JCT
JC1
IR
Auaegg
Stallow Diffee
1.067.00
1.081.06
1.01100
0.868.5
1,01.00
1,011.00
1,0/100
1.668.91
1.08837
1.688.5
0.99855
King
10001.00
0392113
1100199
0163155
1303192
1/209
1/20095
11
1199022
Stullow Difluee
1.601.00
1.00355
0.50035
036m9)
0980152
100/.00
1,81.000
1,00.000
0516.33
0.590.00
0.590.33
0.5008
0.990666
Kine
0390335
0399325
013005
Skallow
1.6617.00
0958.0
0983150
1/81000
1000.00
05600.0
16
Shullow Tifluo
King
1.000.95
0.202L8
83967.59
039881
058m
03
090015
0549124
0200142
097877
0334355
09908:
0460
09980.96
0766.11
0100115
0300.46
0170014
0900.45
0122025
0993146
0.33116
Rine
0.718113
036011
0.300025
Shillow
01590.98
056076
0913147
6.60.6
8450.50
01500.11
0570.33
0
C.3 Ablation Study Different Watermark Patterns
In Table we examine various combinations of watermark patterns M @ W. For the shape of the mask M. "Circle" refers to circular mask M (see Figure top left), while "Ring" represents ring-shaped M. Since the mask centered in the middle of the figure, "Low" and "High" denote frequency regions: "Low" represents DFT with zero-frequency centering, whereas "High" indicates a DFT without zero-frequency centering, as illustrated in Figure bottom. For the distribution of W. "Zero" implies all values are zero, "Rand" denotes values sampled from (0, 1), and "Rotational Rand" represents multiple concentric rings in W, with each ring's values sampled from (1 1).
As shown in Table 8 watermarking in high-frequency regions (Rows 7-9) yields improved image consistency compared to low-frequency regions (Rows 1-6). Additionally, the "Circle" M combined with "Rotational Rand" W (Rows 3 and 9) demonstrates greater robustness than other watermark patterns. Consequently, Shallow Diffuse employs the "Cirele" M with "Rotational Rand" W in the high-frequenee region.
18

---

Table Ablation study on different watermark patterns.
Method & Dataset
Average Watermarking Robustness
PSNR
SSMM
LPIPS
Frequency Region
Shape
Distribution
(AUC 1/TPR@ 1%FPR~)
Low
Circle
7ero
29.10
0.90
0.06
0.93/0.65
Low
Circle
Rand
29.37
0.92
0.05
0,92/0.25
Low
Circle
Rotational Rand
29.13
0.90
0.06
1,00/1.00
Low
Ring
Zero
36.20
0.95
0.02
0.78/0.35
Low
Ring
Rand
38.23
0.97
0.87/0.49
Ring
Rotational Rand
35.23
0.93
0.99/0.98
High
Circle
Zero
38.3
0.96
0.01
0.80/034
High
Circle
Rand
42.3
0.98
0.004
0.86/0.35
High
Circle
Rotational Rand
38.0
0.94
0.01
1.00/1.00
C.4 Ablation Study Watermarking Embedded Channel.
As shown in T we evaluate specific embedding channels e for Shallow Diffuse, where "0, "1," "2," and "3" denote c = 0, 1, 2, 3, respectively, and + 2 + 3" indicates watermarking applied across all channels Since applying watermarking to any single channel yields similar results (Row 1-4), but applying to all channels (Row 5) negatively impacts image consistency and robustness, we set 3 for Shallow Diffuse. The reason is that many image processing operations tend to affect all channels uniformly, making watermarking across all channels more susceptible to such attacks.)
Table 9: Ablation study watermarking embedded channel.
Watermarking Robustness (TPR@ (&PPR))
Watermark embedding channel
PSNR
SSIM
LPIPS L
Clean
JPEG
G.Blur
G.Noise
Color Jitter
36.46
0.93
0.02
1.00
1.00
1.00
1.00
0.99
36.57
0.93
0.02
1.00
1.00
1.00
1.00
0,99
36. 13
0.92
0.02
1.00
1.00
1.00
1.00
1.00
36.64
0.93
0.02
1.00
1.00
1.00
1.00
1.00
+ ++2+
33.19
0.83
0.05
1.00
1.00
1.00
1.00
0.95
C.5 Ablation Study of Inference Steps
We conducted ablation studies on the number of sampling steps, across 10, 25, and 50 steps. The results, shown in Table TO indicate that Shallow Diffuse is not highly sensitive to sampling steps. The watermark robustness remains consistent across all sampling steps.
Table 10: Ablation study over inference steps.
Steps
Clean
G.Noie
CJ
RD
M.B3ar
Watermacking
Rovestess
IC1
(AUL
BC2
DofDlcppe
Rasett
Rinscks
BA
GA
Averaze
1.001.00
0.95/.89
0.550.76
1,001000
LOWLO0
1,001.00
0.99/003
09900.9
1.000.00
L081100
1.809.98
8.63/149
0,740.70
0.950000
1.8011.00
(3
1.001000
1,001.000
01990191
1J001.00
1081100
1,000:92
0.39665
1.001.601
1.001000
1,001.00
1.000.99
0.598445
6.948892
D Robustness Analysis on Geometric Distortions
To further analyze robustness under geometric transformations, we conducted an extended study focusing on rotation, cropping, and scaling.
Controllable Trade-off via Mask Radius. Our framework enables explicit control over the balance between perceptual quality and geometric robustness by adjusting the frequency mask radius r. We compared the original configuration (optimized for visual fidelity) to more robust configuration with expanded radius (-33. Results in Table show show that increasing the radius improves geometric robustness- parttcuulrrtly rotation and cropping while incurring only a mild degradation image consistency.
Here apply Shallow Diffuse the latent space of Stable Diffusion, the channel dimension is 4.
19

---

Table 11: Trade-off between image fidelity and geometric robustness. Increasing the mask radius (r 13) enhances rotation and cropping robustness with minor PSNR drop.
Watermarking Robustness (AUC f)
Setting
CLIP
PSNR f
SSIM
LPIPS
Rotation
Cropping
Scaling
Current (r = 0--0) 0.3669
35,49
0.96
0.02
0.68
0.56
1.00
Robust 3-1331)))
0,3637
32.05
0.95
0.03
0.90
0.89
1.00
E
Generalization to Transformer-Based Diffusion Models
To assess whether Shallow Diffuse generalizes beyond U-Net based diffusion architectures, we conducted an additional study on FLUX 73,, transformer- based diffusion model that employs Flow Matching noise scheduler.
Experimental Setup. All evaluations were performed under server-side watermarking scenario at 512 x 512 resolution. The same watermark design as in the Stable Diffusion experiments was used, with two key modifications to account for architectural differences: (a) the watermark radius was set 5, and (b) watermark injection was applied across all latent channels.
We generated 100 watermarked images and evaluated both consistency and robustness across injection timesteps 0.2T, ...., 0.97). The results are presented in Table 12
Table 12:
Generalization of Shallow Diffuse to the FLUX transformer-based diffusion model.
Watermarking Robustness
Timestep (t/T)
PSNR
SSIM
LPIPS 4
AUC1
ACC
TPR@ 1%FRR
0.1
31.27
0.91
0.05
0.90
0.93
0.87
0.2
31.66
0.92
0.04
0.91
0.93
0.87
0.3
31.68
0.92
0.05
0.92
0.94
0.87
0.4
31.69
0.93
0.04
0.93
0.94
0.86
0.5
31.68
0.93
0.04
0.94
0.93
0.86
0.6
31.56
0.93
0.04
0.94
0.94
0.85
0.7
31.50
0.93
0.04
0.94
0,93
0,81
0.8
31.52
0.93
0.05
0.94
0.94
0.82
0.9
31.62
0.92
0.06
0.94
0.94
0.81
Analysis. To ensure fair comparison of injection timesteps across different schedulers, we matched the effective Signal-to-Noise Ratio (SNR) between the Variance Preserving (VP) schedule used in Stable Diffusion and the Flow Matching scheduler in FLUX. A timestep of t/T 0.3 in VP approximately corresponds t/T 0.205 in Flow Matching when equalizing SNR.
The results indicate that injecting at this equivalent "shallow" timestep achieves the best SSIM (0.93) and near-optimal PSNR (31.7), while also maximizing robustness (AUC 0.94, TPR @ %FPR 0.87). This confirms that the optimal embedding region discovered for Stable Diffusion generalizes to transformer-based architectures, underscoring the broad applicability of null-space embedding framework.
F Comparison with ROBIN
We conduct direct empirical comparison between optimization-free Shallow Diffuse and the optimization- based ROBIN 322 under the server scenario with 1000 generations. Experiment results shown in Table B and [4ble[1
Our experiments show that Shallow Diffuse produces images with significantly higher perceptual quality and consistency. As shown in Table 13 our method achieves PSNR nearly 11 dB higher and a better FID score. We attribute the difference to the frequency domains where watermarks are added: Shallow Diffuse uses the high-free fighffrequency domain, while ROBIN uses the cow-frequency domain.
20

---

Adding the watermark to high frequencies preserves the low-frequency content of the generated image, thereby significantly improving consistency and quality.
In terms of robustness, the two methods are competitive, each with distinet strengths. Table 14 shows that both methods highly robust to most distortion and regeneration attacks. ROBIN demonstrates superior robustness against geometric attacks like rotation (1.0 vs 0.69) and cropping (0.99 vs 0.58), as well adversarial attacks.
This empirical comparison quantifies the fundamental trade-off. ROBIN's optimization process achieves higher robustness for challenging attacks at the cost of significantly lower image quality, longer setup times, and less flexibility. Shallow Diffuse provides a more balanced and practical solution, offering state-of-ther image quality and comparable robustness across wide range of common attacks, all within an efficient, optimization-fre framework adaptable to both server and user needs.
Table 13: Consistency between Shallow Diffuue and ROBIN under the server scenario.
Method
PSNR 1
SSIM
LPIPS
FID 4
CLIP
ROBIN
24.614
0.8261
0.1087
134.8 129.228
0.366
Shallow Diffuse
35.49
0.96
0.05
0.367
Table 14: Robustness between Shallow Diffuse and ROBIN under the server scenario.
Method
JPBG
G.Blur
G.Nose
RK
RD
Watermarking
M.Blar Kotation
Crop
(AUC)
IC1
IC2
18
Rinse4x
BA
GA
ROBIN
0,999
0.999
0.963
0.962
1
0.991
0.988
1
0.939
0.9
Shallow
G Proofs in Section 4
G.1 Proofs of Theorem
Proof of Theorem According to Assumption ! we have | 20.el13 Ja,)),((x.) 1
From Levy's 's Lemma proposed in 74,, given function [J (z.))
Azl gd - R we have:
-C(d 2)
P ([1))o,(<11) Ar 2 E (1))) Ax
e)
< exp
L2
given L to be the Lipschitz constant of [Jo, (xx) 2 and C' is positive constant (which can be taken - ). From Lemma and Lemma we have:
to be C = (1873)-1
PP ([1J0:((r)) Aa [ d
-(18m 1(187))-1 2)²²
(d=2)2²2
26) < 2exp
Define as the desired probability level, set
1 =
-(187))-11 -1 22)
eexp
[|Jo,
Solving for c:
18m3
c= [2
d log (2rz).
21

---

1
Therefore, with probability 1
we have:
7i
| 00 11. = Jo. (20e)
12
A (.,,
18T
+ + Jo,
log (2rz),
d-2 2
r2 + V 187
S 2211Jo.
log (2rz)
Tt
d d- log (2rz)
18
d
where the last inequality obtained from
|J,,(<x))11 S rellJo. (x))). Therefore, with probability
1
Tt | 20,e|12 S AbA
18
+
V d d-2
log (2rz) = ALh(re).
Proof of Theorem 2 According to Equation ① one step of DDIM sampling at timestep / could be represented by PMP fo. (x4) as:
21-1 aa a fos) v1 ac-1
(10)
v1 04
VI ar aaraa-11
VI ac-1va
a1-1 ax
f0,((x)),
(11)
-1-04
If we inject a watermark AA to Tt, so x, W = 0t + AAx. To solve = we could plugging Equation
Equation II
we could obtain:
W
04-1
It
w
Ciyy C4
VT -1 -T-------11 01-1/0 fo,((x)))
(12)
1 at
VT- a+.
-1-1 AA
v1 asy arvaa-11
VI a1-1 aa
-
Jo. (xx Am
(13)
at
/1 04.
1--11
asy 04- /1 31-art 01-1Va
xt-1
+X
I
Jo (o.(
Ax,
(14)
1-at
O4
One step DDIM Inverse sampling at timestep t could be represented by PMP fo,e(x)) as:
1 04 a1-1
a1-1 1i vI an 0h-1 f0
(15)
V1 Q4-1
To detect the watermark, we apply one step DDIM Inverse on x/", at timestep to obtain a!".
W
a4
+
VI
a1-1
/1 -1-a0/0t--
0
So.- 10:
04-1
V1 -4-1
xc +
an
0t-1 V1 a 01y/1-1
Jo.c (0.0-((1611) w,Se, VI 1--a- a--1
0t-1
=W
= =x, + WWW,W,WAA = =x -XW,,WW, - -1
22

---

Therefore:
|| 1 202112 - (W 1) Az]12
=111 ar 1 v1 v1-aryas at-1
v1 11-a4
v1 - aayan1 vi- 0t 11
(0,
vl -1-00-1 0t-1
(V1 - -11-0t 04-1 - v1 - (11---1/01)
Jo 1 (0
01-10
S -a (t-1) ( (1)
Ag (n)
Ag (a at) a-
I -g (c.; - Am
Ag (a)-1, (1 (0,, ar- (J)
= -- (a,, 0r | -0 2|2
+ g (a 01) (1 9 (ax, a111) L) || 20,el12.
The first inequality holds because I (. < 0 and g g az-1) > O. The second in- ( S
equality holds because ||Jo,-- (zx Jo (20e) Azel2 I
(xx)(ll)) From Theorem with probability 1
Tt-1
W 0 20,0-1l1e S ALd((rr1))
1
with probability 1
|| 20.1112 S ALh(re),
Thus, from the union of bound, with probability least 1
1
rt
T=-1
|ل xx 12 S - -Agg (ar, a1-1) h(Tr-1) + ALg (a)-11,,,,0 ar) (1 g (ar. az-1) h(re))
S X-g a1-1) + (x) (1 Lg (ar, ar-1))) ((max
H
Auxiliary Results
Lemma 1. Given a unit vector vn with and e (O, Ia), we have
EeNNiO.LL /|||| d
Proof of Lemma 7 Because E ~ I2).
0/'c~ No::N(Wf00 0, of Iav,) = (o 0, of Lav;) 10,,
(16)
Assume a set of unit vecotrs {ui, 02 Ug...., Ui.... dar are orthogonormal and are basis of Rd similarly, we could show that Vj [d],X, = ofe NO. Therefore, could rewrite
(uTe) c)² /|le|12 as:
(o. T)
(o. (oTT)² 2 /||?|
(17)
Σ d
UK El 1=
(18)
Σ 1= (vāe)²
X?
(19)
EE x?
23

---

Let Y,
X
Because Vj [d] 13 (V Vj [d has the same distribution.
Ej X3 Additionally, Σ j==1 Y3 So:
d
( e)
1 E
1 d'
E Eo
E|I
Σ Yíl
||e|
d
Lemma 2. Given matrix J E Rdxd with rank (J) = Given a which is uniformly sampled on the unit hypersphere Sd-1, we have:
J
Ex
Jæ
Proof of Lemma Let's define the singular value decomposition of J UEVI with Σ diag (TI...... Tr. .).. Therefore, Ex [|] = Ez ||UEV*=| Ez E> where
== V x is is uniformly sampled on the unit hypersphere Sd-1 Thus, we have:
Ex
Σx
Eg
o *
Eg
o
12
||
E
[lle
x|
where is the standard basis with i-th element equals to O. The second equality is because of independence between ef z and eÿ z. The fourth equality is from Lemma
Lemma 3.
Given function f (x) || [2. the lipschitz constant Ly of function (x) is:
Ly 21
Proof of Lemma 3 The jacobian of f(x) is:
vaf(x)= = 2J Jx,
Therefore, the lipschitz constant L follows:
Lf = sup -ER--1
/ = sup
||" = || J|12 |
=esi-1
24

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The paper contributes a watermark for diffusion models, with the method
introduced in Section theoretical justification in Section 4 and experimental verification in Section
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We carefully discuss the assumption in Section
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model cell-speciiiaatinn asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
25

---

Answer: [Yes]
Justification: We carefully discuss the assumption in Section 4 and attach proof in Ap- pendix G
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification:
We discuss detailed experiment settings in Section 5
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, descríbing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e-g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing verifying the results.
5. Open access to data and code
26

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [No]
Justification:
We will make it open source in the future.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips... cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
/ "cippscc/puullc//guu /utee//ggudddeeeedSuuuubmiibii ssionPolicy) for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
We discuss the detailed experiment settings in Section
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [No]
Justification:
Due to computation limits, we are unable to run experiments multiple times.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
27

---

The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative emrr rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification:
All experiments are run over one A40 GPU.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification:
We conduct the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. if there is a special consid- eration due to laws or regulations their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer:
[Yes]
Justification: have discussed Appendix
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
28

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of MI..
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
The paper poses no such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Lieenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We have cited the assets used in the paper.
Guidelines:
existing assets. The answer NA means that the paper does
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
29

---

If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [No]
Justification: We will provide the documentation when releasing the code.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/cooe/mmoel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question:
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
30

---

Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that if the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, or originality the research, declaration is not required.
Answer: [NA]
Justification: The core method development in this research does not involve LLMs any important, original, or non-standard components.
Guidelines:
The answer NA
that the method development in this research does involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy for what should or should be described.
31


Reviews:
[{"review_id": "erI2UHcP9A", "reviewer": "Reviewer_81PW", "summary": "In this manuscript, the authors introduce a robust and invisible watermarking method for diffusion models. It operates in both server-side and user-side scenarios by injecting the watermark into a low-dimensional subspace during generation or via DDIM inversion. The method leverages the null space of the Jacobian in diffusion model sampling to decouple watermarking from image generation. Extensive theoretical analysis and empirical results demonstrate the effectiveness of the proposed method.", "questions": "See the Weaknesses", "limitations": "yes", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "The core idea of exploiting low-rank Jacobians and null space projection is elegant and well-motivated by the observed local linearity in the denoising process of diffusion models. Shallow Diffuse works well in both server and user scenarios.\n\nAlthough built on Stable Diffusion 2.1, it remains unclear how generalizable the approach is to other architectures or modalities (e.g., audio, video diffusion). \n\nWhile consistency metrics are strong, subjective quality comparisons (e.g., human perceptual study or user ratings) are not discussed. Especially in the user scenario, it would be useful to validate perceptual invisibility.\n\nIn line 203, the authors mentioned \"In practice, we choose t 142 ∗ = 0.3T based on results from the ablation study\". Please provide more explanations and is this setting generalizable to other usecases, such as audio, video diffusion", "was_revised": false, "final_justification": "", "rebuttal": "> W1: The method's generalizability beyond Stable Diffusion 2.1 to other architectures or modalities (e.g., audio, video).\n\nA1: We appreciate the insightful comment regarding the generalizability of Shallow Diffuse beyond Stable Diffusion 2.1. While comprehensive evaluation across all architectures and modalities is challenging due to time and resource constraints during the rebuttal phase, we have conducted a focused experiment to demonstrate its generalizability to the FLUX architecture, a representative of transformer-based diffusion models.\n\n**Experiment Settings**:\n\nOur evaluation was performed in a server scenario, generating images at a resolution of 512x512. For the watermark pattern, we largely adopted the settings used for Stable Diffusion, with two key modifications: the watermark radius was adjusted to 5, and the watermark was injected across all channels, given the difference in latent space dimensions between FLUX and Stable Diffusion. We injected watermarks into 100 images, evaluating both their consistency and robustness. The averaged results are summarized in the table below, showcasing performance across various injection timesteps ranging from 0.1$T$ to 0.9$T$.\n\n\n|              | 0.1$T$   | 0.2$T$   | 0.3$T$   | 0.4$T$  | 0.5$T$   | 0.6$T$   | 0.7$T$  | 0.8$T$   | 0.9$T$   |\n|--------------|-------|-------|-------|-------|-------|-------|------|-------|-------|\n| PSNR         | 31.27 | 31.66 | 31.68 | **31.69** | 31.68 | 31.56 | 31.5 | 31.52 | 31.62 |\n| LPIPS         |  0.05 |  **0.04** |  0.05 |  **0.04** |  **0.04** |  **0.04** | **0.04** |  0.05 |  0.06 |\n| SSIM        |  0.91 |  0.92 |  0.92 |  **0.93** |  **0.93** |  **0.93** | **0.93** |  **0.93** |  0.92 |\n| AUC          |   0.9 |  0.91 |  0.92 |  0.93 |  **0.94** |  **0.94** | **0.94** |  **0.94** |  **0.94** |\n| ACC          |  0.93 |  0.93 |  **0.94** |  **0.94** |  0.93 |  **0.94** | 0.93 |  **0.94** |  **0.94** |\n| TPR @ 1% FPR |  **0.87** |  **0.87** |  **0.87** |  0.86 |  0.86 |  0.85 | 0.81 |  0.82 |  0.81 |\n\n\n**Analysis and Generalizability**:\n\nTo ensure a fair comparison of injection points across different noise schedules, we carefully considered the Signal-to-Noise Ratio (SNR). Specifically, a timestep of $t=0.3T$ in a VP (Variance Preserving) noise scheduler (as used in Stable Diffusion) is approximately equivalent to $t=0.205T$ in a Flow Matching noise scheduler (as used in FLUX), when maintaining the same SNR.\n\nFrom the presented results, the injection timestep of $t=0.2T$ on FLUX achieves the best SSIM and near-optimal PSNR and LPIPS. Crucially, it also yields the best TPR @ 1% FPR, indicating good robustness. This finding strongly suggests that the effective SNR (timesteps) for watermark injection in U-Net-based architectures (like Stable Diffusion) successfully generalizes to transformer-based architectures like FLUX, achieving good consistency and robustness. This supports the broader applicability of Shallow Diffuse across different diffusion model architectures.\n\n&nbsp;\n\n---\n\n> W2: Lack of Subjective Quality Comparisons.\n\nA2:\n\nWe thank the reviewer for their valuable suggestion to conduct a subjective evaluation to validate the perceptual invisibility of our watermark. In response to this feedback, we have performed a comprehensive user study that directly addresses this concern.\n\nWe conducted a two-alternative forced-choice (2AFC) A/B test with 10 participants. In this setup, a 50% accuracy rate represents purely random guessing, which is the scientific standard for perfect perceptual invisibility. For clarity in our results, we normalize this by treating 50% accuracy as a 0% effective detection rate.\n\nThe results from our study were definitive. As shown in the table below, our method, Shallow Diffuse, achieved an effective detection rate of only 4%. This result is statistically indistinguishable from random chance, confirming that participants could not reliably perceive the watermark.\n\n\n| Watermarking Method     | Detection Rate | Perceptual Invisibility |\n|-------------------------|----------------|--------------------------|\n| RingID                  | 100%           | Easily Detected          |\n| Tree-Ring               | 98%            | Easily Detected          |\n| Gaussian Shading        | 98%            | Easily Detected          |\n| Stable Signature        | 12%            | Mostly Invisible         |\n| Shallow Diffuse (Ours)  | 4%             | Completely Invisible     |\n\n\n&nbsp;\n\n---\n\n\n> W3: Provide more details on the choice of timestep $t=0.3T$ from the ablation study.\n\nA3:\n\nWe thank the reviewer for asking for a deeper explanation. The choice of $t* = 0.3T$ is not arbitrary but is an empirically optimized decision based on a crucial trade-off.\n\n**Empirical Optimization**:\n\nOur ablation study in Figure 7 systematically evaluates both image consistency and watermark robustness across the full diffusion timeline. These results clearly show that while consistency is highest around $t=0.2T$, robustness peaks at $t=0.3T$. Therefore, $t^* = 0.3T$ represents the optimal balance point where we achieve near-maximal robustness while retaining excellent image consistency.\n\n**Theoretical Justification for the \"Shallow\" Region**:\n\nAs we discuss in the paper (Appendix C.5), based on our theoretical analysis in Theorem 1 and Theorem 2, one might expect the ideal injection point to be where the Jacobian's rank is lowest (around $t=0.5T$ to $0.7T$ as shown in [34]). However, this overlooks the error introduced by the DDIM Inversion process, which is necessary for detection and becomes more pronounced at larger $t$ values. Consequently, the optimal point must balance two competing factors: the Jacobian must be sufficiently low-rank (requiring a reasonably large $t$), but $t$ must not be so large that inversion error degrades performance. The empirically found region around $0.3T$ is this sweet spot.\n\n**Generalizability of $t^*$**:\n\nThe existence of a U-shaped rank curve is a general property of diffusion models, as demonstrated in [34]. Furthermore our experiment for FLUX in A1 also demonstrated the generalized the $t^*$. This implies that an optimal \"shallow\" embedding region, which balances low-rankness with low inversion error, should also be a general feature. While the exact value might require minor tuning for a different modality (e.g., transformer-based diffusion model), the same methodology of performing an ablation study to find this empirical sweet spot would apply, making the approach itself generalizable."}, {"review_id": "034bkeP3r0", "reviewer": "Reviewer_cX6b", "summary": "This paper presents Shallow Diffuse, a watermarking framework for diffusion‑based image generation that operates in a low‑dimensional subspace. Unlike existing approaches that embed watermarks throughout the entire sampling trajectory, Shallow Diffuse injects the watermark at a single, intermediate diffusion step and confines it to a low‑rank subspace. This decoupling from the main generation process helps preserve image fidelity while ensuring the watermark remains detectable and consistent across various post‑processing attacks. The authors derive theoretical guarantees for both watermark consistency and detectability under a low‑rank Jacobian assumption. Empirically, Shallow Diffuse is benchmarked against Gaussian Shading, RingID, and other methods on multiple datasets, demonstrating superior robustness and image quality in both server‑side and user‑side watermarking scenarios.", "questions": "See Weaknesses.", "limitations": "See Weaknesses.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "## Strengths\n\n**1. Solid Theoretical Analysis:** Provides formal bounds on watermark consistency and detectability.\n\n**2. Comprehensive Experiments:** Demonstrates good performance on both server‑side and user‑side.\n\n**3. Clear and Coherent Presentation:**  Algorithm pseudocode, theoretical proofs, and experimental results are well‑organized.\n\n## Weaknesses\n\n**1. Missing Geometric Attack Evaluation:** Omits crucial geometric distortions (rotation, cropping, scaling), which are common in practical  settings.", "was_revised": true, "final_justification": "Please refer to my response to the rebuttal.", "rebuttal": "> W1: Missing Geometric Attack Evaluation\n\nA1:\n\nWe thank the reviewer for their positive feedback on our theoretical analysis, experimental scope, and clear presentation. We appreciate the reviewer's primary concern regarding the omission of geometric attack evaluations, and we agree that assessing robustness against rotation, cropping, and scaling is crucial.\n\nThe reviewer is correct that there is an inherent trade-off between watermark robustness against these geometric attacks and the final watermarked image quality. Our framework allows this trade-off to be explicitly controlled by adjusting the watermark parameters, such as the frequency mask radius. Our original paper presented a setting optimized for maximum image consistency.\n\nTo directly address the reviewer's concern, we have conducted new experiments using a parameter setting optimized for geometric robustness. The results below compare our original setting with this new, more robust configuration. Robustness against rotation, cropping, and scaling is measured by the AUC.\n\n| setting              | CLIP   | PSNR  | SSIM | LPIPS | rotation | cropping | scaling |\n|----------------------|--------|-------|------|-------|----------|----------|---------|\n| current setting (0-10) | 0.3669 | 35.49 | 0.96 | 0.02  | 0.68     | 0.56     | 1       |\n| r=3–13               | 0.3637 | 32.05 | 0.95 | 0.03  | 0.90     | 0.89     | 1       |\n\nThis new data demonstrates the following:\n- **Controllable Trade-off**: By adjusting the mask radius (the r=3-13 setting), we significantly improve robustness to rotation (from 0.68 to 0.90) and cropping (from 0.56 to 0.89). This comes with a slight, controlled decrease in image consistency (PSNR from 35.49 to 32.05).\n- **Maintained Superior Consistency**: Crucially, even with this more robust setting, our method's image consistency remains state-of-the-art. The new PSNR of 32.05 is still higher than all other diffusion-based watermarking methods benchmarked in our original paper's Table 1.\n- **Strong Scaling Robustness**: The results also show that our method is inherently robust to scaling attacks, achieving perfect robustness in both configurations.\n\nOur framework provides the flexibility to tune for strong geometric robustness while maintaining superior image quality compared to existing methods. We thank the reviewer for pushing us to demonstrate this important capability."}, {"review_id": "7p2DyFEB11", "reviewer": "Reviewer_Br52", "summary": "To address the challenge of embedding invisible and robust watermarks in images generated by diffusion models, the paper proposes Shallow Diffuse, a simple and effective watermarking method. It utilizes the insight that diffusion models exhibit low sensitivity to perturbations in specific low-dimensional subspaces of their latent representations. By perturbing only a few diffusion steps along these subspaces, watermarks can be embedded in a way that is imperceptible, robust to post-processing, and compatible with existing models without retraining. Experiments across multiple diffusion architectures show strong robustness and negligible perceptual degradation, even under common corruptions and transformations.", "questions": "-\tUnclear trade-off between perturbation and visual consistency. As a training-free method, Shallow Diffuse perturbs latent variables while aiming to preserve image appearance. Without learning, it is unclear how the method balances invisibility and robustness under strong distortions.", "limitations": "yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths:\n\n-\tTraining-free method is efficient and practical in real world scenario.\n-\tFigure 1 shows the significant advantage of Shallow Diffuse in terms of consistency compared to previous methods.\n\n\nWeaknesses:\n\n-\tLack of analysis on inversion robustness. Shallow Diffuse relies on DDIM inversion for watermark detection, which can be fragile under certain distortions like random drop. The paper does not analyze how inversion quality impacts detection robustness compared to methods like Stable Signature that the watermark is embed in the decoder. Moreover, the robustness of inversion to these attacks has to be discussed.\n-\tRestricted watermark capacity. The method supports only sequential binary watermarks. It remains unclear whether more complex payloads (e.g., graphic watermarks) can be embedded and extracted.", "was_revised": true, "final_justification": "The authors' rebuttal has addressed my concerns. However, since it is not closely related to my research topic, my confidence is 3. I look forward to discussions with the other reviewers. Thanks to ACs, reviewers, and authors .", "rebuttal": "> W1: Lack of analysis on inversion robustness.\n\nA1:\n\nThis is a critical point, and we thank the reviewer for raising it. Our detection does indeed rely on DDIM inversion, and its robustness is paramount. We would like to clarify that our experimental design was explicitly set up to evaluate the end-to-end robustness of the entire detection pipeline, which inherently includes the DDIM inversion step.\n\n-   Empirical Evidence on Inversion Robustness: Our experiments test against 15 challenging attacks, including the \"Random drop\" attack mentioned by the reviewer. Our results in the server scenario (Table 1) and user scenario (Table 2) show that Shallow Diffuse achieves near-perfect detection rates even under these attacks. This empirically demonstrates that the combination of DDIM inversion and our detection mechanism is highly robust. For instance, even after a portion of the image is dropped, the watermark information in the remaining parts is sufficient for the DDIM inversion to produce a latent representation where the watermark is still strongly detectable.\n    \n\nComparison to Stable Signature: While methods like Stable Signature avoid DDIM inversion by embedding the watermark in the decoder, this approach has its own trade-offs. As shown in Table 1, Shallow Diffuse significantly outperforms Stable Signature in generation consistency (PSNR of 35.49 vs. 32.43) and is far more robust to regeneration attacks (average TPR of 0.98 vs. 0.19). This suggests that our approach, while reliant on inversion, provides a better overall balance of consistency and robustness.\n\n&nbsp;\n\n---\n\n>W2: Restricted watermark capacity.\n\nA2:\n\nWe appreciate the opportunity to clarify the capacity and structure of our watermark.\n\nFirst, we would like to correct a potential misunderstanding. The reviewer suggests our method uses \"sequential binary watermarks,\" but our approach actually embeds a 2D, multi-level watermark pattern. As described in Section 3.2 and visualized in Figure 3, the watermark key.\n\n$W$ consists of multiple concentric rings with values sampled from a Gaussian distribution, following the design from Tree-Ring. This is a spatial pattern, not a binary sequence. The choice of a Gaussian-distributed pattern helps preserve image quality by aligning with the statistical properties of the diffusion model's latent noise at intermediate steps.\n\nRegarding capacity and flexibility, our paper already demonstrates the ability to handle complex payloads. The multi-key watermarking experiments in Appendix C.2 and Table 7 show that Shallow Diffuse can successfully embed and detect up to 32 unique, non-overlapping watermarks in a single image. This confirms our method's capacity is significantly higher than a single bit.\n\nFurthermore, the core contribution of our work is a flexible framework for injection, not just a single watermark pattern. The key insight is that injecting the watermark at a shallow, low-rank diffusion step allows the signal to be hidden in the high-dimensional null space, which enhances consistency regardless of the specific pattern used.\n\nTo explicitly demonstrate this flexibility, we have now tested our framework with the more complex watermark pattern proposed in RingID [31]. As shown in the table below, when the RingID watermark is injected using our Shallow Diffuse method, the image consistency improves dramatically compared to the original RingID method.\n\n| Watermark method                         | CLIP-score | PSNR  | SSIM | LPIPS |\n|------------------------------------------|------------|-------|------|-------|\n| RingID                                   |     0.3637 | 14.27 | 0.51 |  0.42 |\n| Shallow Diffuse (using RingID watermark) |     **0.3654** | **28.77** | **0.86** |  **0.06** |\n\nOur method doubles the PSNR and significantly improves other consistency metrics, proving that the Shallow Diffuse framework is not restricted to one pattern but can enhance the performance of various complex watermarks. We will add this analysis to our paper.\n\nFinally, addressing the reviewer's question about more complex payloads, we acknowledge a key limitation shared by this class of methods (including Tree-Ring and RingID). Because the watermark is injected into the model's latent space, the pattern must ideally follow a Gaussian distribution to avoid disrupting the denoising process and negatively impacting image quality. A standard graphic watermark is unlikely to adhere to this statistical constraint. We believe this is a critical point of clarification and an important direction for future research. We will explicitly discuss this limitation in the future version of our manuscript and thank the reviewer for prompting this important discussion.\n\n&nbsp;\n\n---\n\n> Q1: Unclear trade-off between perturbation and visual consistency.\n\nA3:\n\nWe thank the reviewer for this insightful question regarding how our training-free method balances invisibility and robustness. This balance is not arbitrary but is a direct result of our core technical insight: decoupling the watermark from the image generation process.\n\n1.  **Mechanism for Invisibility**:\n    \n\nOur method injects the watermark into a latent $x_t^*$ at an intermediate step. Crucially, we leverage the low-rank property of the Posterior Mean Predictor's (PMP) Jacobian, $J_{θ,t}$. The watermark $Δx$ is designed such that a significant portion of it lies in the null space of this Jacobian. This means the perturbation has a minimal effect on the predicted clean image, as the term $J_{θ,t} \\cdot Δx$ ≈ 0. This preserves visual consistency. Our Theorem 1 provides a theoretical guarantee for this, showing the change to the image is bounded by the low rank of the Jacobian.\n\n2.  **Mechanism for Robustness**:\n    \n\nWhile the watermark is invisible to the PMP's image prediction term, it is carried forward through a separate, noise-related term in the DDIM sampling equation (see Equation 5). Because the watermark and image content are decoupled, attacks on the final image's visual content do not easily destroy the underlying watermark signal, which can be recovered via DDIM inversion. Theorem 2 supports this by showing that the watermarked latent can be recovered with high fidelity.\n\n3.  **Controlling the Trade-off**:\n\nThe trade-off between invisibility and robustness is explicitly controlled by the watermark strength $λ$ and the properties of the frequency mask $M$ (e.g., its radius). We empirically demonstrate this controllable trade-off in the plots in Figure 1 (bottom). By adjusting the mask radius, we can smoothly navigate between higher consistency and higher robustness. Notably, the trade-off curve for Shallow Diffuse consistently outperforms other methods, demonstrating that for any given level of robustness (TPR), our method achieves significantly higher image consistency (higher PSNR/SSIM and lower LPIPS)."}, {"review_id": "foqK3UNt0n", "reviewer": "Reviewer_LsBM", "summary": "This work proposes a diffusion model watermarking technique that embeds signals into a low-dimensional subspace’s null space, aiming to decouple watermark information from image content. The method claims to maintain image fidelity while ensuring robustness against attacks, supported by experiments comparing favorably against existing approaches in quality preservation and robustness.", "questions": "1. The two primary distinctions from Tree-Ring – (a) later-stage embedding and (b) high-frequency localization – appear impactful. Could the authors provide ablation studies clarifying how each contributes to robustness/image quality?\n\n2. Conventional wisdom suggests low-frequency watermarks resist signal processing (compression/filtering) but suffer poor geometric robustness, while high-frequency variants show the inverse tradeoff. Yet Appendix Table 8 reports **identical robustness (1.00)** for low/high-frequency variants (rotational rand circle) under tested distortions. *Would stronger attacks (e.g., aggressive compression or rotation) reveal expected tradeoffs?*", "limitations": "yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "### Strengths  \n1. The focus on authenticating generative model outputs addresses a timely security challenge in real-world deployments.  \n2. Leveraging low-rank PMP Jacobian properties to minimize watermark interference without model retraining demonstrates analytical insight.  \n3. The paper is logically structured and technically accessible, with clear motivation and methodology.  \n\n### Weaknesses\n1. **Robustness Validation:** While multiple attack scenarios are tested, inclusion of **rotation robustness evaluation** would strengthen claims given its prevalence in image manipulations.  \n2. **Contextual Positioning:** Comparison with Robin [1] —which similarly embeds watermarks at shallow diffusion steps and aims for semantic preservation—would better situate the claimed advantages in semantic preservation.  \n\n[1] ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimization. NeurIPS 2024.", "was_revised": true, "final_justification": "See the comments.", "rebuttal": "> W1: Robustness validation: inclusion of rotation robustness evaluation\n\nA1:\n\nWe thank the reviewer for this valuable suggestion. We agree that evaluating against rotation is a critical component of a comprehensive robustness assessment.\n\nTo empirically validate our design and directly address the reviewer's point, we have conducted new experiments evaluating rotation robustness. We found that there is a controllable trade-off between image consistency and rotation robustness, which can be managed by adjusting the watermark's frequency mask radius.\n\nThe table below presents these new results, comparing the original paper's setting (optimized for image quality) with a new setting optimized for geometric robustness. We present the robustness performance in AUC.\n\n| setting               | CLIP   | PSNR  | SSIM | LPIPS | rotation |\n|-----------------------|--------|-------|------|--------|----------|\n| current setting (0-10)| 0.3669 | 35.49 | 0.96 | 0.02   | 0.68     |\n| r=3-13                | 0.3637 | 32.05 | 0.95 | 0.03   | 0.91     |\n\nAs the results show, by adjusting the parameters (r=3-13 setting), we can significantly improve robustness against rotation to a score of 0.91. This is achieved with only a minor trade-off in image quality (PSNR remains high at 32.05), which is still superior to other diffusion-based methods presented in our original paper's Table 1.\n\n---\n> W2: Context positioning: comparison with Robin\n\nA2:\n\nWe thank the reviewer for their insightful feedback and for encouraging us to position our work relative to ROBIN [1]. We agree that this comparison is important for highlighting the unique contributions of Shallow Diffuse.\n\nThe most crucial distinction is that Shallow Diffuse is an entirely training-free and optimization-free method, whereas ROBIN relies on a computationally intensive adversarial optimization process to achieve its results.\n\nWe can break down the key differences as follows:\n\n1. **Mechanism for Invisibility:**\n\nROBIN employs an active hiding process. It first embeds a strong watermark and then uses an adversarial optimization algorithm to generate a special \"hiding prompt guidance signal\" (w_p). This signal actively guides the diffusion model during the later generation steps to conceal the visual artifacts introduced by the watermark. This is a multi-stage process of \"implant then hide.\"\n\nShallow Diffuse achieves invisibility passively and elegantly. Our method does not require any hiding signal or optimization. Instead, we leverage the intrinsic low-rank property of the diffusion model's Jacobian. By embedding the watermark in the high-dimensional null space of this Jacobian, it is naturally decoupled from the image content. This ensures minimal visual distortion as a direct consequence of our embedding strategy, a concept supported by our theoretical analysis in Theorem 1.\n\n2. **Methodology and Cost:**\n\nROBIN requires a dedicated adversarial optimization phase to discover the optimal watermark (w_i) and its corresponding hiding prompt (w_p). This adds a layer of computational overhead before the watermarking can be applied.\n\nShallow Diffuse has no such requirement. Our method is a direct, one-shot injection process based on pre-defined watermark patterns. This makes it more lightweight, efficient, and practical for real-world deployment where on-the-fly watermarking is often necessary.\n\n3. **Foundation of Robustness:**\n\nROBIN's robustness stems from its ability to embed an initially stronger watermark, with the assumption that the subsequent active hiding process will successfully conceal it.\n\nShallow Diffuse's robustness is grounded in its decoupling principle. The watermark is carried through the DDIM sampling process in a mathematical term separate from the primary image content (as shown in our paper's Equation 5). This design makes the watermark signal theoretically less susceptible to degradation from attacks on the final image's visual features, a property supported by our strong experimental results against a wide range of attacks.\n\nIn summary, while both methods insightfully embed watermarks at an intermediate diffusion step, they operate on fundamentally different principles. ROBIN introduces an active hiding mechanism powered by adversarial optimization. In contrast, Shallow Diffuse is a training-free solution that achieves both invisibility and robustness by exploiting the inherent geometric structure of the diffusion model itself.\n\nWe believe these distinctions clearly highlight the unique contribution of our work. In our revised manuscript, we will expand our related works section to include a thorough discussion of ROBIN, detailing both the similarities in approach (i.e., embedding at an intermediate step) and the important differences in mechanism (optimization-based active hiding vs. optimization-free passive decoupling). This will better situate our work and clarify its significance. We thank the reviewer for this valuable suggestion.\n\n[1] Huang, H., Wu, Y., & Wang, Q. (2024). Robin: Robust and invisible watermarks for diffusion models with adversarial optimization. Advances in Neural Information Processing Systems, 37, 3937-3963.\n\n---\n\n> Q1: Provide ablation studies on (a) later-stage embedding and (b) high-frequency localization.\n\nA3:\nWe thank the reviewer for this excellent suggestion to clarify the individual contributions of our method's key components. We have conducted a new ablation study to precisely disentangle the effects of (a) later-stage embedding and (b) high-frequency localization. The results, presented in the table below, confirm that both components are crucial and contribute synergistically to the superior performance of Shallow Diffuse. \n\n| watermark method for ablation      | CLIP-Score | FID   | PSNR  | SSIM | LPIPS | Distortion | Regeneration | Adversarial |\n|------------------------------------|------------|-------|-------|------|--------|-------------|---------------|-------------|\n| tree-ring watermark                | 0.3622     | 25.82 | 16.61 | 0.64 | 0.31   | 0.88        | 0.87          | 0.06        |\n| tree-ring high frequency           | 0.3656     | 25.72 | 25.9  | 0.84 | 0.10   | 0.92        | 0.89          | 0.35        |\n| tree-ring later-stage embedding    | 0.3648     | 25.74 | 20.68 | 0.94 | 0.05   | 0.92        | 0.95          | 0.44        |\n| shallow diffuse (ours)             | 0.3669     | 25.6  | 35.49 | 0.96 | 0.02   | 1           | 0.98          | 0.54        |\n\n- **Baseline (Tree-Ring Watermark)**: The first row establishes the baseline performance, replicating the original Tree-Ring method. It shows low image consistency (PSNR of 16.61) and particularly low robustness against adversarial attacks (0.06).\n- **Contribution of High-Frequency Localization**: To isolate this factor, we modified the baseline to embed the watermark in high frequencies while retaining the early-stage embedding (t=1.0T). As shown in the second row, this single change significantly improves image consistency (PSNR jumps from 16.61 to 25.9) and boosts adversarial robustness by over 5x (from 0.06 to 0.35).\n- **Contribution of Later-Stage Embedding**: To isolate this second factor, we used the original low-frequency watermark but injected it at our proposed intermediate timestep (t=0.3T). The third row shows this also improves consistency (PSNR to 20.68) and yields an even greater improvement in adversarial robustness (from 0.06 to 0.44).\n- **Synergistic Effect (Shallow Diffuse)**: Our proposed method, Shallow Diffuse, combines both high-frequency localization and later-stage embedding. The final row demonstrates a clear synergistic effect: it achieves a state-of-the-art PSNR of 35.49 and the highest robustness across all attack categories, outperforming the sum of the individual modifications.\n\nThis detailed ablation validates that both of our key technical contributions are impactful on their own and work together to achieve the superior performance of Shallow Diffuse. We will add this table and analysis to the appendix of our future manuscript.\n\n---\n\n> Q2: Table 8 reports identical robustness for low/high-frequency variants (rotational and circle) under tested distortions. Would stronger attacks reveal expected tradeoffs?\n\nA4:\n\nWe sincerely thank the reviewer for their insightful suggestion to test our methods against more aggressive attacks. Following this advice, we conducted new experiments using rotation (75 degree) and aggressive JPEG compression (quality=10). The results have provided a much clearer picture of the trade-offs involved and have strengthened the claims of our paper.\n\n| Frequency Region | Shape  | Distribution      | PSNR  | SSIM | LPIPS | rotation | JPEG (quality = 10) |\n|------------------|--------|-------------------|-------|------|--------|----------|---------------------|\n| Low              | Circle | Rotational Rand   | 29.13 | 0.90 | 0.06   | 0.99     | 0.79                |\n| High             | Circle | Rotational Rand   | 38.00 | 0.94 | 0.01   | 0.69     | 0.87                |\n\nThese new experiments reveal several key findings:\n\n1. **Perceptual Invisibility**: As shown by the perceptual metrics, our high-frequency method provides vastly superior invisibility. It achieves a PSNR of 38 and an LPIPS of 0.01, compared to the low-frequency method's PSNR of 29.13 and LPIPS of 0.06. A nearly 9 dB improvement in PSNR signifies a substantial reduction in visible artifacts.\n2. **Rotation Robustness**: The results for rotation now align with conventional wisdom. The low-frequency watermark shows near-perfect robustness (0.99), while the high-frequency watermark is significantly less robust to this distortion (0.69).\n3. **Compression Robustness**: Crucially, and somewhat counter to the expected trade-off, our high-frequency method demonstrated superior robustness under aggressive JPEG compression. It achieved a score of 0.87, outperforming the low-frequency method's score of 0.79."}]

Author rebuttal:

Meta-review: The paper presents a new generation-time watermarking approach that embeds signal via low dimensional subspace of the latent during shallow diffusion steps.

The paper received largely positive final recommendations.  Three reviews argue for acceptance (2x A, 1x BA) and one for rejection (1x BR) notably the latter is an initial recommendation for which no final recommendation was made post-rebuttal.  Two of the positives score are due to upgrade post rebuttal.

The borderline reject (81pw) rating is largely concerned with generalisability beyond SD 2.1.  Authors have shown over some limited examples (100 images) the approach generalized to FLUX i.e. transformer based model.  It seems a sufficient response to the concern, and given there is no reviewer response entered at the time of consolidation I consider the concern addressed. I hope the experiment can be mentioned in the final version.

The borderline accept (cx6b) rating upgraded post rebuttal as most of the technical concerns raised were addressed. The reviewer shared some concerns with reveiwer lsbm on robustness particularly geometric / rotational robustness.  The authors showed the method can be run to trade such robustness for perceptibility.  This is standard for most watermarking approaches. I recognise the important points raised by the reviewer but do not consider strong geometric robustness to be a necessary precondition to demonstrate the core contribution of the paper re null space embedding.  In any case the reveiwer tends to accept.

The accept recommendation from lsbm is due to the experimental analysis addressing their concerns over similarity, at a high level, to ROBIN. I agree the method addresses similar goals but with a different approach. It is shown to perform competitively.  

The other accept recommendation (br52) arises due to clarifications in the rebuttal.

Overall I see no critical issues remaining to stand in the way of accepting the paper. I therefore recommend to accept the work.

-AC
Decision: Accept (spotlight)