DiffKGW: Stealthy and Robust Diffusion Model Watermarking
Authors: Tianxin Wei
Ruizhong Qiu
Yifan Chen
Yunzhe Qi
Jiacheng Lin
Wenxuan Bao
Wenju Xu
Sreyashi Nag
Ruirui Li
Hanqing Lu
Zhengyang Wang
Chen Luo
Hui Liu
Suhang Wang
Jingrui He
Qi He
Xianfeng Tang
Venue: Accepted by TMLR ()

Abstract: Diffusion models are known for their supreme capability to generate realistic images. However, ethical concerns, such as copyright protection and the generation of inappropriate content, pose significant challenges for the practical deployment of diffusion models. Recent work has proposed a flurry of watermarking techniques that inject artificial patterns into initial latent representations of diffusion models, offering a promising solution to these issues. However, enforcing a specific pattern on selected elements can disrupt the Gaussian distribution of the initial latent representation. Inspired by watermarks for large language models (LLMs), we generalize the LLM KGW watermark to image diffusion models and propose a stealthy probability adjustment approach DiffKGW that preserves the Gaussian distribution of initial latent representation. In addition, we dissect the design principles of state-of-the-art watermarking techniques and introduce a unified framework. We identify a set of dimensions that explain the manipulation enforced by watermarking methods, including the distribution of individual elements, the specification of watermark shapes within each channel, and the choice of channels for watermark embedding. Through the empirical studies on regular text-to-image applications and the first systematic attempt at watermarking image-to-image diffusion models, we thoroughly verify the effectiveness of our proposed framework through comprehensive evaluations. On all the diffusion models, including Stable Diffusion, our approach induced from the proposed framework not only preserves image quality but also outperforms existing methods in robustness against a wide range of attacks.

Published in Transactions on Machine Learning Research (02/2026)
DiffKGW: Stealthy and Robust Diffusion Model Watermark- ing
Tianxin Wei', Ruizhong Qiu', Yifan Chen', Yunzhe Qi', Jiacheng Lin', Wenxuan Bao', Wenju Xu², Sreyashi Nag;, Ruirui Lis, Hanqing Lu,, Zhengyang Wang', Chen Luo", Hui Liu", Suhang Wang', Jingrui He², Qi He², Xianfeng Tang"
University of Illinois Urbana- Champaign
Hong Kong Baptist University
3 Amazon
Pennsylvania State University Microsoft
Reviewed OpenReview:
http:///ppaaaerrr..eee//////l/lt
Abstract
Diffusion models are known for their supreme capability to generate realistic images. However, ethical concerns, such copyright protection and the generation of inappropriate content, pose significant challenges for the practical deployment of diffusion models. Recent work has proposed a fiurry of watermarking techniques that inject artificial patterns into initial latent representations of diffusion models, offering a promising solution to these issues. However, enforcing specific pattern on selected elements can disrupt the Gaussian distribution of the initial latent representation. Inspired by watermarks for large language models (LLMs), generalize the LLM KGW watermark to image diffusion models and propose stealthy probability adjustment approach DifKKGW that preserves the Gaussian distribution of initial latent representation. In addition, we dissect the design principles of state-of- the-art watermarking techniques and introduce a unified framework. We identify a set of dimensions that explain the manipulation enforced by watermarking methods, including the distribution of individual elements, the specification of watermark shapes within each channel, and the choice of channels for watermark embedding. Through the empirical studies regular text-to-image applications and the first systematic attempt at watermarking image-to-image diffusion models, thoroughly verify the effectiveness of our proposed watermark identification framework through comprehensive evaluations. On all the diffusion models, including Stable Diffusion, our approach induced from the proposed framework not only preserves image quality but also outperforms existing methods robustness against a wide range of attacks.
1 Introduction
The rise of diffusion models has significantly impacted image generation, enabling the creation of diverse and high-quality images across various styles. However, the widespread use of these models also introduces critical ethical challenges, particularly concerning copyright protection and the generation of inappropriate or misleading content. In this regard, watermarking generated images offers a promising approach to tracing image origins and mitigating potential misuse.
A core challenge in image watermarking identification the trade-off between the robustness of the watermark and the quality of the generated images. Traditional watermarking techniques (AI-Hajj 2007 Navas al., 2008) primarily rely on post-processing methods embed subtle modifications into the image's frequency

---

Published in Transactions on Machine Learning Research (02/2026)
applications 0.91
applications 0.91
Sample
AI has shown advancements in
directions 10.00 04
directions 0.04
LLM
many applications
(a) Original Distribution
(b) Watermarked Distribution
(c) Output
Sample Input
Dîffuse
Diffusion
Sunset over a calm lake
Figure 1: Illusrationn of the watermarking process, showing the relationship between LLMs and diffusion models. (a) Original Distribution: Initial probability distributions for both LLM and diffusion models. (b) Watermarked Distribution: Adjusted probabilities for selected elements, with red/greet split in the LLM echoed in the diffusion model's modified red/green sampling distribution. (c) Output: Sampled outputs with watermarks.
representation, making them imperceptible to human users. Though effective, these approaches suffer from reduced image quality and insufficient robustness against common attacks such as compression and cropping, to name a few.
improve the trade-off, end-to-end deep learning methods (Zhang al. 2019 Zhu al. 2018 Hayes
Danczis 2017) are proposed to construct watermarks with powerful learning capabilities, while such methods are black-box and require additional training. Specifically for diffusion models, latent-reprreenttaiinn-be
watermarking methods (Wen et al. 2023 Yang al. 2024 have been developed, which embed watermarks by manipulating latent representations to match predefined patterns.
However, enforcing a specific pattern on selected elements can disrupt the independent and identically distributed (II) Gaussian distribution of the initial latent representation. Inspired by watermarks for large language models (LLMs), we generalize the LLM KGW watermark (Kirchenbauer et al.) 2023) image diffusion models and propose stealthy probability adjustment approach that preserves the Gaussian distribution of initial latent representation, illustrated in Figure [ Tn addition to that, the key components thereof are poorly understood, and the connections between watermarking methods remain unclear. In this paper, we carefully analyze state-of-the-art watermarking methods, and introduce a unified framework that identifies and connects the underlying design principles. This framework reveals three critical design dimensions: ① the distribution of individual clements, the specification of watermark shapes within each channel, and the choice of channels for embedding. Under the unified framework, we integrate key designs from both image and language watermarking: we propose novel, training maeeiigg-rree watermarking approach that applies directly to diffusion models without altering the training procoss. Notably, method embeds watermarks directly into the latent space of diffusion models (rather than the frequency domain), avoiding extraneous operations and errors during detection. Extensive experiments are conducted; in addition to conventional focus on text-to-imane fo-image generation, we extend the application scope of our proposed image watermarking to the sconarios involving imago-to-image diffusion model. Our mothod turns out both preserving visual quality of generated images and providing robustness against a wide range of adversarial attacks.
In summary, paper contributes the following:
We present unified taxonomy that identifies and connects the key design principles underlying state-of- the-art watermarking identification methods.
Under the unified watermark identification taxonomy, we propose novel, training-free watermark- ing method, and theoretical analysis showing preservation of the latent representation distribution is accompanied.
2

---

Published in Transactions on Machine Learning Research (02/2020)
Input Noise
Element Sampling
Shape Design
Diffusion Model
Channel Selection
Figure 2: Structured overview of diffusion watermarking. In the embedding phase, watermark signals are injected into the latent noise along three orthogonal dimensions: (1) element sampling, which selects latent positions for modification; (w) shape design, defining geometric structures such as rings or patches; and (dtt) channel selection, identifying robust latent channels. The modified latent is then denoised by the diffusion model to produce the watermarked image.
We extend watermarking techniques beyond the traditional focus on text-to-image generation scenario, and give the first systematic approach to watermarking image-to-image diffusion models. Our proposed method exhibits robustness against a variety of adversarial attacks and high visual quality, validating the efficacy of our method as well as the unified framework.
2 Preliminaries
In this section, we recap the diffusion process, LLM KGW watermarking, and provide a holistic framework for diffusion watermarking. comprchensive survey of related work is provided in Section 6
2.1 Diffusion Process
This section recaps key concepts of Latent Diffusion Models (LDMs), focusing on the diffusson process, denoising methods like DDIM, and inversion techniques for watermark detection. To map rogular image #xxx3 to the latent space, Latent Diffusion Models (LDMs) formally behave as an autoencoder, using encoder F. to obtain the representation reconstructs the image æ from the latent space as x = D(zo). In generating images, (dropping the encoder E and) directly feeding a random signal žu to the decoder of pre-trained LDM can provably return an image following the pre-training distrribution. In addition to the autoencoder framework, LDMs leverage a diffusion-liko process to obtain Zg. Specifically, an initial latent representation 27 hxxxee is first sampled from standard Gaussian distribution (0, I); subsequently, ilerative denoising methods like DDIM (Song et al. 2020 are used to transform 2T into 20, and the decoder then generates the image: D(2o).
Diffusion.
as 20 F((x) E Taxxuxe; conversely, decoder D
Inversion. Beyond standard LDMs, inversion techniques (Dhariwal & Nichol 2021] enable moving in the opposite direction from generated image back to the initial noise state. Previous empirical findings Wen et al. 2023) suggest that DDIM inversion reliably reconstructs the initial noise, with ey x ær. DDIM inversion can thus be used for watermark detection. Given a generated image æ and its associated starting noise 27, we apply DDIM inversion to recover éT. This property allows us to compare the reconstructed noise to the original to detect embedded watermarks effectively.
3

---

Published in Transactions on Machine Learning Research (02/2026)
2.2 LLM KGW Watermark
Here introduce the basic LLM KGW watermark (Kirchenbauer et al. 2023 Zhao et al. 2024b) briefly.
Let be secret key, and let è be a token from the vocabulary V. We can partition V into two subsets of equal size: GreenList and RedList.
Given the original distribution p(t | C) over tokens under context C, KGW watermarking modifies sampling by allowing tokens only from the GreenList:
p(t |C) E GreenList,
Peruna [C) [C=
Z
EE RedList,
where Z -= ZvEv GreenLiit p(t' CC) is a normalizing constant. This ensures that all sampled tokens belong to the GreenList, leaving a distinct distributional footprint that can be verified during test time.
3 A Structured Overview of Watermarking
Pipeline overview. Figure 2 illustrates a concise end-to-end overview of our approach, covering both the embedding and detection phases of diffusion watermarking. To embod a robust and stcalthy watermark, we calegorize latent watermarking methods into Uhree orthogonal design dimensions: which selects latent positions for watermark injection; @ watermark shapes, defining geometric structures such rings patchos; and @ channel sclection, identifying latent channels that yield the most stable watermark signals. In the embedding phase, watermark bits are injected into the latent noise 27 according to these dimensions, and the modified latent žτ is then denoised by the diffussin model to produce the final watermarked image. During detection, DDIM inversion reconstructs the latent êт from given image (possibly attacked), and the same three dimensions are used to statistically verify watermark presence.
element sampling,
Sampling of Individual Elements. The first dimension concerns how values are assigned to each element. Tree-ring Wenn et al., 2023 sets a constant value in the Fourier frequency domain within each circle, forming a ring-like pattern. Ring-ID (Ci ct al.) 2024) refines this by applying the pattern only to the real part of the Fourier transform, enhancing imperceptibility. Post-hoc methods like DwtDetSVD (Cox et al. 2007) modify wavelet coefficients, adjusting DCT singular values in the DWT domain for watermark embedding. Gaussian-shading (Yang et al. h024h embeds the watermark in the spatial domain by sampling values from constrained distribution. Learning- baaeeddg--aeeddd methods, such as Stable Signature (Fernandez et al.
2023 and
AquaLoRA FFnn et al. 2024), tune model weights to integrate the watermark.
Design of Watermark Shapes. The second dimension defines the watermark shape within each h w channel. Tree-ring (Wen et al. 2023) and Ring-ID (Ci et al. 2024 use concentric rings in the frequency domain to target specific components, improving robustness against geometric transformations. DwtDetSVD (Cox et. al. 2007) embeds watermarks into pixel blocks within the combined DWT and DCT domains, while Gaussian-shading (Yang et al., 2024) also employs block-based embedding to improve noise resistance. Learning- based methods distribute the watermark across all locations, adapting the embeddiig to training conditions.
Choice of Channels for Watermark Embedding. The third dimension involves selecting channels for watermark embedding among the channels. Tree-ring (Wen et al. 2023) and post-hoc methods like DwtDetSVD (Cox et al. 2007) embed watermarks in specific channels based empirical insights, prioritizing those less sensitive to perceptual changes to preserve image quality. In contrast, Gaussian-shading (Yang et al. 2024), Ring-ID (Ci et al. 2024), and learning-basee met distribute the watermark across all channels with empirical selection strategies, utilizing the full latent space to enhance robustness against: attacks.
Insights from the Unified Framework. By structuring latent watermarking methods into throe dimen- sions, our framework enables systematic comparison and reveals key challenges in existing approaches: how to sample individual elements akin to distributionnppreervvin methods in L.L.M watermarking for stealthy yet.
4

---

Published in Transactions on Machine Learning Research (02/2026)
detectable embedding, how to design watermark shapes resilient to both noise and geometric transformations, and how to develop channel selection for effective watermarking.
4 Methodology
In this section, based on the identified dimensions, we generalize the LLM KGW watermark to image diffusion models by preserving the distribution, well as addressing vision-specific challenges in shape and channel dimensions to enhance the robustness and stealthiness of the watermark.
4.1 Basic: Generalizing LLM Watermarking
3 previous methods like Tree-ring, Ring-id, and DwtDetSvd heavily relied on setting selected watermarked elements to pre-defined constants. However, the fixed-value operations can substantially disrupt the IID nature of the latent reprosentations, considcring the x w x elements in a latent representation are indeed IID standard univariate Gaussians (0, 1). Moreover, under various allacks these elements can easily be altered, making the watermark difficult to detect.
As discussed in Section
To overcome these limitations, propose distributtinn-preervviin watermarking technique (the charac- teristic of distribution preservation is reflected in Lemma D. Inspired by the LLM KGW watermarking method (Kirchenbauer et al. 2023: Zhao et al. 2024b) widely studied in large language models (LLMs), we aim to adapt its principles to diffusion models. However, directly applying KGW to diffusion models is non-trivial. Unlike LLMs, which sample discrete tokens from a categorical distribution, diffusion models operate a contimuous latent space, requiring distinct approach to maintain distribution preservation. To this end, we divide the density function ((x) of the standard Gaussian distribution into two regions (Red and Green) of equal probability 0.5. Specifically, origin, yielding two TruncatedGaussial distributions over (-o0, 0] and (0, oo). Each latent element 27. is assigned to one of these truncated intervals based on the watermark bit m E {0, 1}, ensuring that the latent representations adhere to the following distribution:
partition the standard Gaussian distribution at the
p(s)) 400 if 0, 50
Ptrune (2
m)
( if 1, 27 >
otherwise (Red Region)
where <0-) is the standard Gaussian density function, and *(.) is its cumulative distribution function (CDF), where (0) 0.5. To be specifie, this distribution can be computed as follows:
1El if m = O, +1E),
{~,(0..1.
(2)
m 11
Figure 3 illustrates the sampling process of our proposed method. This approach can also be extended to multiple (i.e., more than 2) cumulative probability portions lo encode more walermark bits.
The following lemma shows the proposed watermarking technique distribution- (a detailed proof and its gencralized multi-bit extension are provided in Appendix B.1)
Lemma (Marginal Distribution of Elements (Galli et al. 1994 Del Castillo 1994 Yang et al. 2024
Every element in the latent representation of truncated Gaussian marginally follows the standard normal distribution, (0, 1).
4.2 Robustness and Stealthiness via Shape Design
Compared to LLM watermarking, image watermarking requires specifying the watermarking shape for each channel, i.c., the collection of elements to be watermarked; watermarks uniformly applicd across the entire input can be overly sensitive to various transformations, making detection vulnerable to noise, distortions, local perturbations. In this regard, previous works primarily define watermark embedding shapes
5

---

Published in Transactions on Machine Learning Research (02/2026)
Original
m=
m=1
PDF
Green Region Redd Regiio Diviee
Green Region
Red Rlgionn
Diiiee
Figure 3: Standard normal distribution partitioning based on watermark value m. The left shows the original Probability Density Function (PDF), while the middle and right plots illustrate the "green" and the "red' regions for m and I, respectively, with the dividing line al x The values sampled from the green region.
Reglor
Divide
Green Regiony
Figure 4: Visualization of Gaussian Ring Watermarking for geometric robustness. The left image shows two Gaussian rings embedded in the latent space, with deep green and light green indicating the two rings. The top and bottom examples on the right illustrate how different truncated Gaussian distribution are mapped to these rings in the latent space.
ring-shaped (Wen al. 2023 block-shaped (Cox et al. 2007), or learnable values distributed across all locations (Zhang al. 2019.. In this section, will illustrate how to specify the shapes for the watermark, to improve robustness and stealthiness.
"Gaussian Ring" Watermarking for Geometric Robustness. Given the more specific requirement handle geometric transformations, we introduce an alternative approach to complement our framework: injecting the so-called "Gaussian Rings" into the representation of the latent space. The concept of "ring" implics reprosentation tensor divided by series of disjoint rings, which naturally inherits the "redundancy" idea and euhances robustness.
In detail, each Gaussian Ring is a meticulously structured ring-shaped watermark carrying a specific watermark value, designed to provide rotational invariance. As shown in Figure ! the clements on a ring with a specific radius share the same watermark value, all sampled from a truncated Gaussian with designated ("green") region. Our method embeds ring-shaped watermarks directly in the spatial domain, enabling seamless integration with the diffusion process without requiring frequency-based transformations. The process is illustrated in Algorithm I of Appendix A.2
"Random Gaussian" Watermarking with Redundant and Dispersed Watermarks. The idea of " "Random Gaussian" is to introduce redundancy to attain resistance to attacks. Inspired by Vision Transformers (Dosovitskiy et al., (020), we split the initial input into patches, each carrying an identical watermark matrix W of the same shape the patch; every element of W is a watermark value denoting the "green" " region. This redundancy strengthens robustness, information from multiple patches can be

---

Published in Transactions on Machine Learning Research (02/2026)
aggregated during detection; even if some patches are compromised, ensemble methods help reconstruct the watermark, as formalized in the proposition in the next subsection.
However, redundant patterns over block-shaped patches notably introduces another challenge the substantial degradation of generation quality due to the artificial structuring of the imput. To maintain image fidelity while preserving watermark robustness, we move away from the concept of fixed block-shaped patches, and instead suggest randomly coordinated shapes that exhibit more natural distribution (c.f. the illustration in Figure 5 and the technical analysis in Proposition 2). Technically, will uniformly sample permutation of the representation elements and then adopt the block-shaped specification, which thoroughly disperse the clements. To ensure high-quality randomness, we employ the Chacha20 encryption algorithm [ernsteii
et al. 2008). The method is illustrated in Algorithm 2 of Appendix A.2
4.3 Theoretical Analysis on Robustness and Stealthiness
We first show that ensemble methods of multiple patches help ensure reliable and robust detection.
Proposition 1 (Patch Aggregation Robustness). Let zт represent the latent representation in a diffusion model, with r denoting the probability of independently correctly detecting a watermark for an individual pizel. Given p patches, each containing elements, assume 3 and p >> 1. Then, the probabilily Tp of jointly detecting the wotermark across all patches can be approrimated by
(r- Vr(L-r)
Tp ~ +
where ((),, the cumulative distribution function of normal distribution, is monotonically increasing function.
We model the detection outcomes across p patches as independent Bernoulli variables with parameter By invoking the Central Limit. Theorem, the proportion of correctly detected patches can be approximated by a Gaussian distribution N (r. -il-r)).
This formulation provides a key insight into the aggregation mechanism: the variance scales inversely with the number of patches. Consequently, provided that the single-patch detection is better than random guessing (r > }), the probability mass rapidly concentrates around the mean p increases, effectively separating the distribution from the random guessing baseline. This variance reduction thus boosts the joint detection probability Tp, ensuring robust performance even with weak individual signals, as evidenced in Table 4
Stealthiness means that the watermark is visually imperceptible and that watermarked and non-watermarked images remain indistinguishable distribution. In our setting, this enforced by preserving the sampling distribution of the latents during watermark injection. To validate the claim that dispersed watermarks induce more natural representation distribution, we show in the following proposition that the correlation of two elements quickly diminish with the patch size n, and the limiting covariance matrix is thus akin to the one of multivariate standard normal distribution. (The proof is provided in Appendix B.2)
Proposition (Stealthiness of the Watermarked Distribution). Let be the number of patches and n indicate the number of pizels in patch. The normalized Bures Wasserstein (BW) distance dew between the watermarked sampling distribution and (0, is at most
ånw(zr,NN(,, 1))
2
p
π
2T
where | denotes the size of ZT.
The proposition above suggests that as long as p < |2r|, the joint distribution of the watermarked latent representation 2γ well approximates the i.i.d. standard Gaussian distribution A/ /) of the non-watermarked latents. Furthermore, by varying p, we can control the tradeoff between generation quality and robustness (also empirically validated in Table 4. For instance, a latent representation of size 512 x 512, sctting p 64 results correlation of approximately 10-4, ensuring that the joint distribution closely follows an i.i.d. Gaussian.
7

---

Published in Transactions on Machine Learning Research (02/2020)
Fixed
Randomized
Figure 5: Comparison of Random Gaussian watermarking between fixed and randomized patches. Different colors represent distinct patches. The left plot shows a fixed patch arrangement, while the right plot displays randomized patch configuration.
4.4 Channel Selection for Watermarking
To enhance robustness against various attacks, we propose hybrid strategy that adaptively applics the 'Random Gaussian' and 'Gaussian Ring" techniques across channels, building on the shape specifications in Section
Imprinting. To effectively integrate the two methods, adopt channel rating strategy determine the watermarking technique to apply, specifically by calculating the sensitivity to geometric transformations. For a channel (a slight abuse of notation), we compute the magnitude of the gradient w.r.t. to a geometric transformation loss ggoo:
g: 1 Lgoo =5th) [( D(=
where 26 represents the initial latent representation of channel D(zo), D(2)0t) denote the images generated by zr before and after 90 degree rotation, respectively, and I|-12 denotes the Euclidean norm. Clearly, the channel with the largest gradient magnitude Je is more sensitive to geometric transformations, and we will apply Gaussian Ring watermarking to enhance their robustness against geometric attacks. Conversely, for other channels with smaller gradient magnitudes, we will apply Random Gaussian watermarking to better handle non-geometric attacss. The full procedure is illustrated in Algorithm 3 of Appendix A.2
Detection aggregation along channels. During the watermark detection process, we calculate the accuracy for each channel by evaluating whether the elements of a(c) (a certain channel of the representation êr, an X w matrix) fall into the specified "green" shape The so-called "accuracy" Acc(2]) (0) e is calculated as:
27 w²) for channel
No 12 e Green Region(m")}
((c) Acc(2()) m))
No
where No is the number of watermarked elements in channel c, o is the i-th element of channel c, mf the watermark value for channel c, and 1(-} is the indicator function, which equals 1 if the event is true and 0 otherwisc. The overall watermark recovery accuracy is determined by aggregating the accuracy across all channels. To adaptively address varying attack scenarios, we propose the combined watermark accuracy to select the most robust component:
Acc (m) = max Acc(2(e) m²)
cEC...
where C'm is the set of all channels. By detecting both random and ring watermark patterns, even if one of the watermarks is compromised by a specific attack, the others can still be detected, enhancing overall robustness. By combining these methods, the total watermark capacity is greatly increased, as the combined capacity becomes the product of the individual capacities of each watermarking technique.
In addition the practical detection based accuracy metric, testing procedure depicted Appendix B.3

---

Published in Transactions on Machine Learning Research (02/2026)
Table 1: APR&I%FPM under different attacks for Stable Diffusion, showing the effectiveness our method
over number of attacks.
Method
Clean
Rotation
JPEG
Cr. & Sc.
Blurring
GauNNise
Color Jitter
StePNoise
Regeneration
Flip
Avg.
DwnDer
0.909
0.027
0.008
0,092
0.011
0.354
0.126
0.089
0.016
0.023
0.166
Dwr.DeSvv
0.057
0.021
0.269
RivaGan
0.987
0.012
U.756
0.702
0.428
0.541
0.694
0.477
0.025
0.027
0.472
Stable Signature
0.816
0.624
0.843
0.072
0.414
Pree-Ring
1,000
0.477
0.995
0,902
0.939
0.926
0.900
0.987
1.000
1,000
0.922
Gaussion Shading
1.000
0.007
0.999
1,000
1.000
0.999
0.992
0.999
1,000
0.057
0.508
AquLoRA
1,000
0.013
0.987
0,941
1.000
0.954
0.847
0.693
0.812
0.133
0.738
DinKGW (Ours)
1.000
0.852
1.000
1,000
1,000
0.996
0.996
1.000
1.000
0.998
0.984
5
Empirical Results
We conduct experiments on two widely-used diffusion scenarios: text-to-image diffusion models and image-to- image diffuusin models, to evaluate the effectiveness and robustness of our watermarking technique across various attack scenarios. Additionally, we perform ablation studies in Section 5.3 for a deeper analysis of the method.
5.1 Experimental Setting
Our paper first evaluates the proposed method text-to-image diffusion models, focusing Stable Diffusion (SD) (Rombach et al. 2022 v2.1/2.0/1.4 The generated images have resolution of 512 512, with latent space of 64 x 64 x 4. For inference, we use prompls from Stable-Diffusion-PPrnn Prompt, setting the guidance scale to 7.5, and generate images over 50 steps using DPMSolver (Lu et al. 2022). The watermark radius r varies from 5 to 15 in steps of 2. Images are divided into patches of 64 elements each. Given that users often share generated images without prompts, we perform inversions with an emply prompt and a guidance scale of 1, using 50 steps of the DDTM method (Song et al. 2020).
We also test our watermarking approach in diffusion models. Specifically, employ instruct-pix2pix (Brooks et al. 2023 fine-tuned Stable Diffusion model. Editing tasks use DDMM inversion with an empty prompt and original image, setting the guidance scale to 1.
editing using pre-trained image-condiiioned
For image quality evaluation, we adopt Frechet Inception Distance (FID) (Heusel et al. 2017) and CLIP- Score (Radford et al. 2021). FID is computed on the CCC02017 validation set, which contains 5,000 images. CLIP scores are measured between generated images and text prompts for Stable Diffusion, and between edited images and ground truth descriptions for instruct-pix2pix. We exclude SSTM and PSNR, as they assess post-hoc modifications, whereas our method manipulates latent representations, aligning with prior
works (Wen et al. 2023 Yang ct al.] 2024).
For detection, following WWen et al. 2023 Yang et al. 2024h, we compute the true positive rate (TPR) at a fixed false positive rate (1% FPR). In traceability, we assess identification accuracy across watermark patterns. AUC and TPR01%FPR are calculated using 1,000 watermarked and 1,000 unwatermarkod images per run, averaging results over three runs with different random seeds.
5.2 Performance of the Proposed Method
To benchmark the robustness of our watermarking method, we evaluate its performance against widely used Augmentation-basse attacks and generative Al-based attack, Regeneration (Zhao et al. 2023a), which leverages diffusion model for regeneration and denoising, We exclude image-to-image translation and oditing methods, as they produce significantly altered images with varying concepts. Additional potential adversarial threals exist, such as recovering structured watermark patterns from degenerate or lightly edited images, reusing extracted watermark signals across samples, and overwriting an existing watermark with a new one. These attacks fall outside the scope of our current benchmark but represent mcaningful directions for future investigation. Details of the attacks are in Appendix A.1 and Table I presents the TPR@1%FRR results. Our DiffKGW watermarking method outperforms Tree-Ring, particularly under rotation (0.852
9

---

Published in Transactions on Machine Learning Research (02/2026)
Table 2: Performance comparison of different watermarking methods on Stable Diffusion under clean and adversarial conditions. The metrics are split into two categories: Fidelity and Robustness.
Robustness
Fidelity
Methods
TPR @1%FPR
AUC
Accuracy
FID (L)
CLIP-Scare
Clean
Adv.
Clean
Adv.
Clean
Adv.
Stable Diffusion
25.23
0.363
DwtDDt
0.909
0.166
0.974
0.574
0.950
0.527
25.28
0.364
DwdDetSyd
1,000
0.269
1.01X)
0.702
1,000
0.691
25.01
0.359
RivaGAN
0.997
0.472
0.854
0.998
0.802
24.51
0.361
Stable Sigusture
1,000
0.111
1.000
0.818
1,000
0.751
25.15
0.364
Tree-Ring
1.000
0.922
1.000
0.993
1,000
0.979
25.29
0.363
Gausian Shadiing
L,000
0.509
1.000
0.911
1.000
25.20
0.364
AquaLoRA
1.000
0.738
1.000)
0.671
1,000
0.817
25.50
0.363
DHiKGW (Ours)
1.000
0.984
1.000
0.999
1.000
0.994
25.20
0.363
Table 3: Detection TPR with different sampling methods in diffusion models.
Sampling Method
Noise
DDIM
UniPC
PNDM
DEIS
DPMSolver
Clean
1,000
1,000
1.000
1.000
L.000
Adversarial
0.978
0.972
0.983
0.982
0.984
CLIP-Score
0.363
0.362
0.363
0.363
0.363
vs. 0.477) and noisy conditions like Gaussian noise (0.996 vs. 0.926). While Gaussian Shading excels in noise robustness (e.g., 1.000 for blurring), it struggles with geometric transformations (0.007 for rolation). Overall, our method achieves the highest average performance, demonstrating strong resilience against both geometric and noise-basod attacks. Additional results on the instruct-pixépix model and imago-to-imago editing scenarios are in Table (Appendix A.3 while watermark capacity and identification analyses are in Appendix A.4. further confirming our method's superiority.
Table 2 shows the average detection performance across various attacks, demonstrating our method's 's robustness and superiority over baselines in resisting adversarial manipulations. In fidelity, it maintains comparable FID and CLIP-Score values, ensuring minimal impact on image quality. Moreover, its independence from custom model components enables seamless integration into different diffusion models. Appendix(A. presents results on SD v1.4, v2.0, and Dreambooth (Ruiz et al. 2023), further validating its effectiveness.
Our study focuses watermarking methods that are integrated into the diffusson generation process, where watermark signals embedded directly into the latent noise prior to denoising. This paradigm fundamentally differs from post-procsssing walermarking techniques that modily already-generated images {Lu et al.) and from optimization- based approaches (Zhang et al. 2024). Accordingly, we do not include direct comparisons.
5.3 Ablation Studies
We conduct extensive ablation studies on several key hyperparameters of our proposed method to demonstrate the effectiveness of our method. To validate the generalization our approach, we evaluated five commonly used sampling methods in diffusion: DDIM (Song et al. 2020), UniPC (Zhao et al. 2024a), PNDM (Liu) et al. 2022), DEIS (Zhang & Chen 2022). and DPMSolver (Lu et al., 2022). As shown Table 3 with our proposed watermarking technique, all sampling methods demonstrate excellent and comparable performance, particularly in clean conditions where all methods achieved perfect detection rate. Under adversarial noise, DPMSolver shows marginally better detection rate, but overall, all sampling methods maintain high robustness.
Table Q shows that larger patch sizes improve robustness against adversarial attacks but reduce image quality, as reflected by a lower CLIP-Score. For ring radius, placing the ring near the center (*0-5" Table 5) degrades generation quality by embedding key structural and semantic information, while a medium radius ("5-15") provides the best. balance between rotation robustness and image quality.
10

---

Published in Transactions on Machine Learning Research (02/2026)
Table Ablation with different patch sizes.
Table 5: Ablation with different ring radii.
Patch Size
4
16
64
256
Ring Radius
0-5
5-10
0-10
5-15
10-15
None
0.993
1.000
1.000
1.000
None
1.000
1.000
1.000
1.000
1.000
Adversarial
0.757
0.924
0.984
0.986
Rotation
0.512
0.643
0.828
0.852
0.767
CLIP-Score
0.364
0.363
0.363
0.359
CLIP-Score
0.361
0.363
0.359
0.363
0.363
Comparison of Win. Tie, and Loss Counts
1.0
Channel-wise Accuracy Gradient Comparison
1.0
Stable Diffusion NS-COCO
1823
1150
0.8
0.8
Normalized Gradient
2500
3050
Accuracy
0.64
0066
0.4
0.4
0.2-
0.2
400
363
231
0.0
0.0
Channel 0
Channel 1
Channel 2
Channel
Channels
Win
The Categories
Loss
(a) Channel-wise analysis.
(b) Win Tie/Loss comparison.
Figure 6: Left: Quantitative comparison of accuracy and normalized gradient across four channels. Right: W'in/Tie/Lonn statistics between watermarked and hon-watermarked outputs on the Stable-Diffusion and MS-COCO datasets. "Win" indicates higher performance for watermarked images, "Tie" similar performance, and "Loss" higher for non-watermarked.
For watermark channels, the experimental findings Figure 6a show substantial variation in performance across different channels, with Channel achieving the highest accuracy. Notably, the computed gradient values align eloscly with the robustness accuracy for each channel, indicating that gradient strength is reliable indicator of channel performance. This suggests that channels with stronger gradients are better suited for embedding the Gaussian Ring Watermark, providing useful guideline for selecting the optimal channel for watermarking to enhance specific robustness.
Due to space constraints, ablations on Gaussian Ring and Random Gaussian watermarks are in Appendix A.5 and analyses on inversion steps, inference steps, and multi-bit encoding are in Appendix A.6 all demonstrating the effectiveness of method.
5.4 Analysis Channels
Additionally, we compare the CLIP-Scores of the non-watormarked and watermarkod results for each input prompt from the Stafle-Diffusion and MS-COCO datasets. If the CLIP-Score difference is less than 0.01, it is considered tie; otherwise, it is classified The comparative results are presented in Figure 6b
win for either the watermarked or -on-watermrreed result.
From the lable, we observe that the watermarked images sometiimes outperform and other times underperform the non-watermarked images, with no consistent trend favoring one over the other (similar win and loss counts with win rato=00.5). This demonstrates the robustness and effectiveness of our watermarking method, as it preserves the generation quality while embedding the watermark without introducing systematic degradation enhancement.
11

---

Published in Transactions on Machine Learning Research (02/2026)
Non-watermarked
Watermarked
Oripinal
Non-watermarked
Watermarked
Wild turkeys on top the dried pasture
Make painting
blue train on train tracks about to go under bridge
the pathway be made of gold
(a) Text-to-image Diffusion
(b) Image-to-image Diffusion
Figure 7: Visualization of both the watermarked and non-watermarked generated images in different scenarios.
For image-to-image editing, we also include the original images. More visualizations are shown in Appendix C
5.5 Visualization
Figure 7 visualizes watermarked and non-watermarked diffusion--eneraaae images, showing that our method preserves semantic information and high visual quality. In text-to-image diffusion, watermarked images remain visually similar to non-wattrmarked ones while retaining intended semantics. In diffusion, they cxhibit even greater similarity to the original and non-watermarked images due to additional guidance from the input. These results confirm that our mot effectively embeds the watermark while maintaining image integrity. Additional visualizations are Appendix C
6 Related Works
In this section, comprehensively review the related works watermarking images and recent extensions to diffusion models.
1994) embedd traceable identification information in carrier data for copyright protection and content authentication. Traditional image water- marking techniques, often applicd in post-processing, focus on frequency domain mothods (Cox et al. 2007
Watermarking Image. Digital watermarking (Van Schyndel et al.
Al-Haj 2007 Hamidi et al. 2018 Kundur & Halzinakos 1997 Lee el al., 2007 Navas el al. 2008) to enhance robustness. For instance, DwtDetSvd (Cox et al. [007] combines Discrete Wavelet Transform, Discrete Cosine Transform, and Singular Value Decomposition for watermark embedding. More recently, deep learning-based
2022 Zhang al. 2019 Hayes & Danezis 2017) like RivaGAN [Zhang et al. 2019) leverage neural networks to improve watermarking, employing adversarial networks for both embedding and extraction. Despite advancements, post-hoc watermarking often introduces visible noise and is vulncrable to attacks like cropping and compression (Fernandez et al. 2023 as is applied to the final image, making the watermark prone to distortion or removal.
approaches (Zhu et al. 2018 Tancik al. 2020 Fernandez et al.
Watermarking Diffusion Models. With the rise of generative models, particularly diffusion models, watermarking AT-generated content-or or the models themselves wha become increasingly important. Yu ct al. (2021) and ZZhao al. (2023b) proposed embedding watermarks into training datascts so that models inherently generate watermarked content. However, this approach may pose practical issues for large-scale diffusion models trained on vast datasets. To address this, researchers have explored embedding watermarks during the generation process. For example, Fernandez et al. (2023) and Feng et al. (2024) fine-tuned model
weights to modify latent representations, with Stable Signature (Fernandez et al. 2023 fine-tuning LDM
decoders to embed hidden watermarks in generated images albeit at. the cost of extensive training and various data augmentations.
Other approaches, like Tree-ring watermark (Wen et al. 2023). modify the initial noise in the sampling process, requiring deterministic samplers like DDIM (Song et al. 2020 for watermark extraction through
12

---

Published in Transactions on Machine Learning Research (02/2026)
inversion. Yang et al (2024) proposes distribution preserving method to adjusts the initial noise naturally, improving robustness against noise additions. However; Wen et al. (2023) is less resilient to noise and cropping attacks, while Yang et al. (2024) remains sensitive to geometric transformations. Despite these efforts, the fundamental principles behind effective watermarking and the connections among different methods remain poorly understood. Inspired by these works, we identily key design dimensions for embedding watermarks the latent space, providing insights into diffusion watermarking techniques.
7
Conclusion
this paper, we adapt the principle of language watermarking to image diffusion and introduce unified framework dissect watermarking approaches for diffusion models along three distinct dimensions. By addressing vision-specific challenges in shape and channel dimensions, innovatively instantiate an effective holistic model under this framework, maintaining high fidelity, and ensuring robust watermarking against various attacks. Extensive evaluations of text-to-image applications show our model outperforms state-of- the-art methods. We further validate its effectiveness on image-to-image diffusion models, highlighting a substantial advancement in digital watermarking.
Acknowledge
This work is supported by National Science Foundation under Award No. IIS-2117902. The views and conclusions are those of the authors and should not be interpreted as representing the official policies of the funding agencies or the government.
References
Ali Al-Haj. Combined dwt-det digital image watermarking. Journal of computer science, 3(9):740-744) 2007.
Daniel J Bernstein et al. Chacha, variant of salsa20. In Workshop record of SASC, volume 8, pp. 3-5. Citeseer, 2008,
Tim Brooks, Aleksander Holynski, and Alexei A Efros. Instructpix2pix: Learning to follow image editing instructions. In Proceedings of the IEEE/CVP Conference on Computer Vision and Pattern Recognation, pp. 18392 18402, 2023.
Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification. arXiv preprint 0rX55 2024.
Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker, Digital watermarking and steganogrophy.
Morgan kaufmann, 2007.
Joan Del Castillo. The singly truncated normal distribution: A non-steep exponential family. Annals of the Institute of Statistical Mathematics, 46:57 66, 1994.
Prafulla. Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advances in neurol information processing systems, 34:8780 8794, 2021.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa. Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, al. An image is worth 16x16 words: Trranfformers for image recognition at scale. arXie preprint arXiv:2010. 1.00..11111 11929, 2020.
Weitao Feng, Wenbo Zhou, Jiyan He, Jie Zhang, Tianyi Wei, Guanlin Tı, Tianwei Zhang, Weiming Zhang, and Nenghai Yu. Aqualora: Toward white-box protection for customized stable diffusion models via watermark lora. In Forty-forst International Conference on Machine Learning, 2024.
Pierre Fernandez, Alexandre Sablayrolles, Teddy Furon, Hervé Jégou, and Matthijs Douze. Watermarking images in self-supervised latent spaces. In ICASSP 2022-2022 IEFE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 3054-30564 IEFF, 2022.
Pierre Feruandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The slable signature: Rooting watermarks in latent diffuusinn models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 22466 22477, 2023.
13

---

Published in Transactions on Machine Learning Research (02/2026)
A Galli, H. Beucher, G Le Loc'h, B Doligez, and Heresim Group. The pros and cons of the truncaled gaussian method. In Geostatislical Sinculation:: Proceedings of the Grostatistical Simalation Workshop, Fonlaincbleau, France, 27-28 May 1993, pp.
Springer, 1994.
Mohamed Hamidi, Mohamed El Haziti, Hocine Cherifi, and Mohammed El Hassouni. Hybrid blind robust image watermarking technique based on dft-dct and aroold transform. Multimedia Tools and Applications, 77:27181222111 2018.
Jamie Hayes and George Danezis. Generating steganographic images via adversarial training. Adnonces neural information processing systems, 30, 2017.
Martin Heusel, Hubert Ramsaner, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems, 30, 2017.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, lan Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning, pp. 17061 17084. PMLR, 2023.
Deepa Kundur and Dimitrios Hatzinakos. A robust digital image watermarking method using wavelet-based fusion. Proceedings of International Conference on Image Processing, pp. 514 547. IEFE, 1997.
Sunil Lee, Chang D Yoo, and Ton Kalker. Reversible image watermarking based on integer-to-integer wavelet transform.
IEEE Transactions on information forensics and security, 2(3):321-23 330, 2007.
Luping Liu, Yi Ren, Zhijie Lin, and Zhou Zhao. Pseudo numerical methods for diffusion models manifolds. arXiv preprint arXiv:2202.0999 09778, 2022.
Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm-solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps. Advances in Neural Information Processing Systems, 35: 5775 5787, 2022.
Shilin Lu, Zihan Zhou, Jiayou Lu, Yuanzhi Zhu, and Adams Wai-Kin Kong. Robust watermarking using generative priors against image editing: From benchmarking to advances. In The Thirteenth International Conference Learning Representations.
KA Navas, Mathews Cheriyan Ajay, M Lekshmi, Tampy S Archana, and M Sasikumar. Dwt-dct-svd based water- marking. In 2008 3rd international conference communication systems software and middleware and workshops (COMSWARE'OS) 008), pp. 271-274. IEEE, 2008.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Miihknin, Jack Clark, al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pp. 8748 8763. PMLR, 2021.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusson models. In Proceedings of the IEEE/CVF conference computer vision and pallern recognition, pp. 10684-10695, 2022.
Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kftr Aberman. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 22500-225 2201000 2023.
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXie preprint arXiv:2010.02502 2020.
Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical photographs. In Proceedings of the REE//CVF conference computer vision and pattern recognition, pp. 2117-2126, 2020.
Ron G Vau Schyndel, Andrew Z Tirkel, and Charles F Osborne. A digital watermark. In Proczedings of 1st international conference on image processing, pp- 86 90. TEEF, 1994.
Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings watermarks: Invisible fingerpriuts for diffusion images. Advances Neural Information Processing Systems, 36, 2023.
14

---

Published in Transactions on Machine Learning Research (02/2026)
Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shading: Provable performance-lossees image watermarking for diflussin models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Paltern Recognition, pp. 1162212171, 2024.
Ning Yu, Vladislav Skripniuk, Sahar Abdelnabi, and Mario Fritz. Artificial fingerprinting for generative models: Rooting deepfake attribution in training data. In Proceedings of the IEEE/CVP International conference on computer vision, pp. 14448 14457, 2021.
Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni, Robust invisible video watermarking with attention. arXiv preprint arXiv:1909.014 01285, 2019.
Lijun Zhang, Xiao Liu, Antoni V Martin, Cindy X Bearfield, Yuriy Brun, and Hui Guan. Attack-resilient image watermarking using stable diffusion. Advances in Neural Information Processing Systems, 37:38480 38507, 2024.
Qinsheng Zhang and Yongxin Chen. Fast sampling of diffussion models with exponential integrator. ar preprint orXiv:2204.1900 19902, 2022.
Wenliang Zhao, Lujia Bai, Yongming Rao, Jie Zhou, and Jiwen Lu. Unipe: A unified predictor-corrector framework for fast sampling of diffusion models. Advances in Neural Information Processing Systems, 36, 2024a.
Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generalive ai. arviv preprinl KKiv:2306.0195:. 2023a.
Xuandong Zhao, Prabhanjan Vijendra Ananth, Lei Li, and Yu- Yu-Xiang Wang. Provable robust watermarking for ai-generated text. In The Twelfth International Conference on Learning Representations, 2024b.
Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Ngai-Man Cheung, and Min Lin. A recipe for watermarking diffusion models. arXie preprint arXiv:2908. 10187, 2023b.
Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In Computer Vision ECCV 2018: 15th European Conference, Munich, Germany, September 8-14, 2018, Proceedings, Part XV, pp. 682 697, Berlin, Heidelberg, 2018 Verllag,- ISBN 978-3-030-01266-3. doi: 10. 10.1007/998---0000002222 URL http:://boo...og//00000////////0
40.
15

---

Appendix
Contents
More on experiments
A.1
Implementation Details
17
A.2
Pseudo Code of Proposed DitkKWW
17
A.3
Empirical Results on Instruct- Instruct-pix2pix
17
A.4
Watermark Capacity and Identification
18
A.5
Ablation Study on Random Gaussian and Gaussian Ring
18
A.6
Ablation Study on Inference and Inversion Steps.
19
A.7
Porformance on Different Diftusion Models
A.8
Runtime Analysis
19
Robustness Evaluation!
19
B
Proofs omitted in the main text
20
B.1
Proof of Lemma
20
B.2 Proof of Proposition
22
B.3
Illustration of the Statistical Test
25
C
More on Visualization
25
More Generation Results
25
C.2 Failed Examples
25
Broader Impact Statement and Limitations
26
E
GenAI Usage Disclosure
26
16

---

Published in Transactions on Machine Learning Research (02/2026)
A
More on experiments
The code and model weights will be open-soureed after the review procedure.
A.1 Implementation Details
The attacks implemented in the paper include Gaussian blurring with filter size of Gaussian noise with standard deviation of 0.05, JPEG compression with ratio of 25%, and salt-and-pepper noise with a probability of 0.05. Additionally, we evaluate against brightness adjustments where the factor is set to 6, random cropping and resizing with 75% ratio, rotation by 75 degrees, and horizontal and vertical flips with probabilities of 0.5 each. We also incorporate a generative model-based attack, DeNoise, as introduced by Zhao al. (2023a), which leverages a diffusion model to denoise the output, aiming to remove any potential watermark. To be specific, their method first encodes the watermarked image into the model's latent space, then applies 50 forward diffusion steps, consistent. with our diffusson setup, to oblain noised latent representation. It subsequently runs the reverse denoising trajectory to recover cleaner latent, which is finally decoded back into pixel space to produce image intended to suppress climinate the embedded watermark.
For the Gaussian Ring Watermark, the watermark radius r ranges from 5 to 15, with an interval 2. For the Random Gaussian Watermark, we divide the images into patches, with each patch containing 64 elements. Furthermore, to enhance the randomness and security of the watermark, we employ stream key, cryptographic key used in encryption algorithms generate sequence of pseudo-random values. Following Yang et al. (2024), employ stream key to encrypt the watermark, which consists of binary values (0/ 1), into a randomized version m using an encryption method like ChaCha20 (Bernstein et al. 2008). The encrypted watermark W, now uniformly distributed, avoids detectable artifacts while maintaining alignment with the natural data distribution.
A.2 Pseudo Code of Proposed DiffKGW
In this subsection, we illustrate the pseudo-code of the algorithms in our proposed DiffKGW framework.
Algorithm Gaussian Ring Watermarking (Channel c)
Require: (c)
27 E R ring boundaries fro, Po.."....,TKk pre-randomized watermark bits {bi, (bi,bg... be.b..,bbyyy
1: for each pixel (i,j) in 2T do
(c)
2: dist + V(2 h/2)² + +
3: for = to do
4:
if Tk-1 S dist <T then m + bk
Retrieve watermark bit for ring k
6:
2/ (t.j) t TrunatedGaanssia(m)) Eq.
7: end if
end for
end for
10: return 2/()
A.3 Empirical Results Instruct-pix2pix
The experimental findings in Table demonstrate that, even in the more challenging image-to-image diffusion sccnarios, our method maintains high robustness across various attack types, with an average AUC of 0.927. In contrast, the performance of the Tree-Ring method siguificantly declines, possibly because it sets selected values to constants, heavily relying on inversion precision. In image-to-image settings, inversion more difficult due to the absence of multiple inputs including the conditional oditing prompt and input image during the inversion process. This highlights the strength of our method, which can achieve robustness even when inversion accuracy is compromised, further underscoring its effectiveness in complex scenarios.
17

---

Published in Transactions on Machine Learning Research (02/2026)
Algorithm Gaussian Random Watermarking (Channel c)
Require: 2T E R patch size p, pro-randomizod watermark matrix W {0, 11(1/)((w/D)
Partition 2T into patches of size p
2: for cach patch k do
3: for each pixel (pp) in the corresponding patch do
4: m - (1p:
Retrieve watermark bit
5: (ip:))) + TruncatedGaaussia((n)) Eq. 1
end for end for
Combine all patches (P(1), p(2),... ,.... plexl) to reconstruct 247
9: return ((e)
Algorithm DifiKGW
Require: 2T E RxxwxC Decoder D(-), Rotation function rot(-), Lyeo(zo Zroto) = (zo) D (
1: for c= to do
Extract channel =(c)
+ D(T),, Lot + D(rot(zT)
ÖLgao
Compute gradient ge +
0zy
5: end for
6: c* + arg max. Jc
7: for c = to do
if e* then
Apply Gaussian Ring (Alg. 1 on 27
(c)
10: else
11:
Apply Gaussian Random (Alg. 12: end if
2T
13:
end for
14: return Watermarked latent 2T
A.4 Watermark Capacity and Identification
The experimental results in Table 7 demonstrate the superior capacity and robustness of our watermarking method compared the Tree-Ring approach. In our method, two distinct watermarks are injected into different channels, each carrying and bits of information. This results in 2a and 2 possible patterns for each channel, and when combined, the total capacity becomes 2 This significantly increases the capacity and enhances the distinguishability of the watermarks compared to constant value- based approaches like Tree-Ring The results show that across various use cases and watermark patterns, our method consistently achieves high identification accuracy, while the Tree-Ring approach fails, especially under adversarial conditions. These findings underscore the effectiveness of our method in maintaining both traceability and identification accuracy, even in challenging adversarial scenarios.
A.5 Ablation Study on Random Gaussian and Gaussian Ring
The experimental results in the Table show that both the Random Gaussian and Gaussian Ring watermark patterns are critical to the success of our method. The Random Gaussian watermark demonstrates greater robustness against noise-based atlacks, as indicated by the high performance in noise-related vests (e.g., Salt & Pepper Noise: 0.996), while the Gaussian Ring watermark shows superior robustness to geometric transformations, such as rotation (0.011 for without Gaussian Ring, compared 0.841 with Gaussian Ring). Despite this, both patterns perform well individually, achieving strong results across various attack scenarios. The combination of the two watermarks in our method results in the highest. overall performance (average
18

---

Published in Transactions on Machine Learning Research (02/2026)
Table 6: AUC under each Attack for Instruct-pix2pix maage-to-imaas diffusion, showing the effectiveness of our method over a number of attacks.
Mothod
Cloan
Rotation
JPEG
Cr. & Sc.
Blurring
GauNoise
Color Jitter
S&PNoise
DeNoise
Flip
Avg
DwtDet
0.342
0,301
0.322
0.288
0.315
0.271
0.265
0,292
0.268
0.279
0.315
DesDDe
0.603
0.312
0.411
0.355
0.428
0.362
0.344
0.305
0.318
0.293
0.373
RivaGan
0.712
0.366
01557
0.521
0.408
0.476
0.505
0.422
0.388
0.351
0.480
Stable Signature
0.734
0,401
0.612
0.386
0.413
0,512
0.588
0.335
0.392
0.336
0.196
Tre--ling
0.689
Gaussian Shading
0.963
0.532
0.961
0.921
0.913
0,912
0.912
0,912
0.916
0.525
0,853
AquaLoRA
0.781
0.452
0.703
0.631
0.702
0.655
0.508
0.474
0.501
0.402
0.500
Ours
0.988
0.830
0.976
0.941
0.970
0.914
0.946
0.920
0.942
0.841
0.927
Table 7: Traceability and identification accuracy across 32 distinct watermark patterns.
Method
Clean
Rotation
JPEG
Cr. & Sc.
Color Jitter
GauNoise
Avg
Tree-Ring
0.435
0.012
0.401
0.045 0.984
0.412
0.505
0.302
Ours 1.000
0.828
0.992
0.980
0.982
0.961
0.984), demonstrating that these patterns are not only effective but also complementary, enhancing the overall robustness when used together.
A.6 Ablation Study Inference and Inversion Steps.
The experimental findings in Table 10 demonstrate that different inversion steps consistently perform well in terms of detection accuracy, with minimal loss when there is mismatch between inference and inversion steps. In real-world scenarios, the exact inference step is often unknown, which can result in this mismatch. However, the table shows that detection performance remains robust across various combinations of steps. Given the efficiency of existing samplers and the optimal performance observed with 50 inversion steps, we select 50 steps as a balanced trade-off between accuracy and computational efficiency.
Encoding multiple k bits involves dividing the distribution into 2 regions, designating one the green region while treating all others red. The detection performance remains comparable, with an increase in encoded bits generally enhancing detection. However, encoding too many bits per element may may negatively impact overall image quality.
A.7 Performance Different Diffusion Models
Our method is independent of custom model components, allowing seamless integration into various diffusion models (DMs). In the paper, we evaluate our method on Instruct and Stable Diffusion (SD) V2.1. Additionally, we further validate its generalizability on SD V1.4, V2.0, and DreamBooth below, covering different architectures, training data, and objectives. Our method shows consistent robustness.
A.8 Runtime Analysis
As shown in Table 11 the actual watermarking cost minimal: Tree-Ring is the fastest, but our method also requires only 0.028 for embedding and 0.0017 for detection. In contrast, diffusion and inversion take over second, mcaning our watermark introduccs minimal overhead to the generation pipeline.
A.9 Robustness Evaluation
As shown Figure incrcasing the intensity of blur or noise progressively reduces the watermark detection rate, which is expected because strong corruptions severely distort the image itself. Even under extremely destructive conditions such when 80% of the pixels are replaced by noise, method still maintains
19

---

Published in Transactions on Machine Learning Research (02/2026)
Table Comparison of detection performance (TPRQ (FPP) across various methods under different attack
scenarios, including Random Gaussian removal, Gaussian Ring removal, and the proposed method (Ours).
Method
Clean
Rotation
JPEG
Cr. & Sc.
Blurring
GauNoise
Color Jitter
S&PPNoise
DeNoise
Flip
Avg
Rundom Gaussian
0.954
0.982
0.952
w/o Geussian Ring
1.000
0.011
1.000
1.000
0.986
0.904
0.988
0.906
1.000
0.015
0.799
Ours
1.000
0.852
1.000
1.000
1.000
0.996
0.996
1.000
1.000
0.998
0.984
Table Detection (PR01%FPM) with different inversion and inference steps.
Inversion Step
Inference Step
10
25
50
100
10
0.975
0.976
0.973
0.970
25
0.968
0.978
0.981
0.981
50
0.965
0.967
0.984
0.982
100
0.965
0.966
0.977
0.984
reasonably high detection accuracy. This demonstrates that the watermark signal remains resilient even when the visual content is heavily degraded.
B Proofs omitted in the main text
B.1 Proof of Lemma I
Proof. Let Z be random variable representing the value of element in the latent representation. The pixel Z is sampled based on a watermark bit B E (0, which determines the region of the Gaussian distribution from which Z is drawn.
The conditional distribution of given is:
pz]p(2f/u) = (2(z)) 2f R(w).
0, otherwise,
where d(x) 1 - 2//2 is the standard normal probability densily function, and R(w) is defined as: /TT
(-o,,), OJ. (0, 00),
if wf O, if w 1.
R(w)=
The watermark bits B are assumed to be independent and uniformly random, i.e., P(B 0) = P(B = 1) The marginal distribution of Z then:
pz(2f)= = Σ P() w)
wE(0.1)
1
2
22( 1:750
+ 20(2f)1
2
2
-(2f))
[12550 + 1,500]
b(2f).
Therefore, Z marginally follows the standard normal distribution A0 1).
20

---

Published in Transactions on Machine Learning Research (02/2026)
Table 10: Detection TPR017FPR with different encoding watermark bits per element.
# Bits
1
3
None
1.000
1.000
1.000
Adversarial
0.984
0.985
0.987
CLIP-Score
0.363
0.363
0.360
SD v1.4
SD
DreamBooth
Model
Clean
Adv.
CLIP-Score
Clean
Adv.
CLIP-Soore
Clean
Adv.
CLIP-Store
Base Model
0.349
0.358
0.352
+ Gaussion Shading
1.000
0.788
0.348
1.000
0.814
0.358
1.000
0.763
0.352
+Ours
1.000
0.976
0.349
1.000
0.987
0.358
1.000
0.969
0.353
We further provide the proof for the generalized multi-bit setting as follows.
Proof.
Let B = (bi....,byy bm) E 10, be independent, uniform watermark bits, and define
B(B) = bの 2m j E f0......" ." - 1}.
==1
We define k(B) as the integer index corresponding to the binary vector B, establishing a one-to-one mapping between and its interval RR(B). Partition into equiprobable intervals
k --1
k + 2m
))
R
k == 0. 2 1,
2
so that Pr[Z E R&] = 2-m where + and Φ-1 denote the standard-normal CDF and its inverse.
Define the conditional density latent element as
2 o()), if Ry(b):
P b)
0,
otherwise,
where d(z) = 12
2m
Regardless of m, the marginal distribution of Z remains standard normal:
Z 1(0
By marginalizing over B.
pz(2))
Σ
PZ|B
( bb) P(B b)
b
2
(2f) 1
Σ
n 6(2f) 1 Rv
2m
k=0
2
Σ
1 (2f)
k=
)(2+),
since {Ra} forms disjoint cover of IR, the of indicator functions equals 1.
21

---

in the tensor is Published in Transactions on Machine Learning Research (02/2026)
Table 11: Runtime comparison among different watermarking methods.
Method
Embed
Detect
Diffusion Model
1.84s (Diffusion)
1.25s (Iuversion)
Tree-Ring
0.0060s
0.0008s
Gaussian Shading
1.57s
0.0021s
Ours
0.0280s
0.0017s
Performance under
Performance under S&P Noise Attack
1.0
AUC
1.00
Accuracy
TPR@1%FP
Metric Value
0.6
0.90
0.4
0.85
0.80
Accuracy
1PR@1%FPR
0.0
10
20%
40%
60%
80%
Gaussian Blur Radius
S&P Noise Probebiltyy
(a) Gaussian Blur attack.
(b) Salt-and-Pepper noise attack.
Figure 8: Performance degradation under increasing attack strength. Left: AUC, Accuracy, and
TPR@1%FPR curves under Gaussian Blur with inereasing blur radius. Right: AUC, Accuracy and TPR01% 1FRR curves under Salt-and- Peppee noise with increasing noise probability.
B.2 Proof of Proposition
iih 2T and 2T d's'k'
Proof- We first show that the correlation between any two different elements given by
Corr(2 igk 2
2 π
p p-1
2T
Consider two elements X and Y within a latent representation divided into p patches, each containing n pixels, totaling |2T| = pm pixels. Pixels within the same patch share a common watermark bit W, while those in different patches have independent watermark bits.
Cov(X, (o,XX Y) = E[XY] B
Given B[X] = Y = 0, this simplifies to:
= Yov(Xy))=[[xT
When X and Y are in the same position across different patches, they share the same watermark bit W. Given W. X and Y are independent and follow Half-Normal Distribution with variance x² 1.
The probability density function (PDF) of Half-Normal Distribution with variance o² is
2 fr(u) = V exp
y² 2 0.
2
The expectation E[Y] is calculated
22

---

Published in Transactions on Machine Learning Research (02/2026)
W = 11 =
fr dy
1 dt (where y²
2 e
π
22t
2
Similarly, for W = 0,
B|y W 0] =
Since X and Y are independent given W,
2 2 V
E| = W
When X and Y are in different positions across different patches, their watermark bits Wx and Wy are independent. Therefore,
[[XY]Differee Positions] E [Y] = 0.
The probability that two randomly selected pixels are in the same position across different patches is #Same Position
p 1
P.
#Total
Tip
Combining the cases, we have
2 EXY = Ps + P.) 0=
2
np 1
Given that Var(X) Var(Y) the correlation p is:
p = C)) Cov(X,Y) 2 p
VVrr(X)arr()) np
Furthermore, we prove the normalized Bures Wasserstein (BW) distance dew between the watermarked sampling distribution and (000T) 7) is at most
2 p
dew(er,N(0..1) I)) S p
-
Let Σ be the covariance matrix of a centered Gaussian latent distribution with correlation parameter p as defined in our paper. Then the normalized Bures- Wasserstenn distance dgw between this distribution and the standard normal (o, Tnp) satisfies
BW2
dew np
<,,
i.e. the normalized Bures Wasserstein distance (BW2) is upper bounded by the correlation p.
BW2 Tr(E) Tr(Tap) 2Tr(52122
23

---

Published in Transactions on Machine Learning Research (02/2026)
is the squared Bures- Warsessassrrttnin distance between Gaussian distribution with covariance Σ and the standard normal (o,, Inp)- Consider a spiked covariance structure
Σ = (1- + p11", 1- (1, 1)² E R
So that Tr(E)= = np, which is a constant denotes the size zy. Factor out (1 -p):
= (1-111100 (Lmp + uu)),
u
1 p
where u Tuu n== = O(np).
For rank-1 perturbation S= I uu rank-1 1 update admits closed-form square root:
51/2 = 1 vI + 1
u u
Hence
/1/2 v1 plnp + 1111)
and its trace is
Tr(E!/3) -1 pnp
- 0(1).
Plugging this into the BW formula gives
BW np + mp 2(111 prp O(1)) 2mp(1 - -1- p) 0(1).
Using the identity
p
1- 11 =
1 v1
obtain
BW2 2mp
0(1) npp.
1 /1 - 0
Thus, for large np,
BW2
< P
np
meaning the normalized Bures Wasserstein distance is bounded by p.
24

---

Published in Transactions on Machine Learning Research (02/2026)
B.3 Illustration of the Statistical Test
In this work, our primary focus is on evaluating the actual performance of the watermarking method. However, a statistical analysis can also be derived. Let m E {0, 1] represent a k-bit (independent) watermark embodded in the model. We extract the message m' from an image I and compare it with m. As outlined in previous works, the detection test based on the number of matching bits, A(m, m'). Specifically, if
A(m, m') 2 T where T ko....,k).
then the image is flagged. This approach provides a level of robustness against imperfections the watermarking process.
Formally, we test the statistical hypothesis H1: 'image was generated by the watermarked model' against the null hypothesis Ho: "image was not generated by the watermarked model." Under Ho (i.e., for non- watermarkod images), we assume that the bits mi...., m' are independent and identically distributed (i.i.d)) Bernoulli random variables with parameter of 0.5. Consequently, A(m, m') follows binomial distribution with parameters (k, 0.5). This assumption has been experimentally validated.
The thcoretical FPR is defined as the probability that A(m, m') exceeds the threshold т. It is calculated using the CDF of the binomial distribution. closed-form expression can be derived using the regularized incomplete beta function L (a; B):
FPR(T) P(M H(H)) I1/((T 1, 7).
C More on Visualization
C.1 More Generation Results
In this section, we provide additional generation results illustrate that our watermarking method maintains comparable generation quality. Results for Stable-Diftusion prompts are presented in Table 12 and Table [3] while generation results for MS-COCO captions, including the textual prompts, generated images, and corresponding realistic images from the MS-COCO dataset, are shown in Table 14 and Table 15
All generated images effectively capture the information conveyed by the textual prompts. In some cases, the watermarked images show slight improvements in quality (e.g., the 1st prompt from Stable-Diffusion) while others exhibit minor degradation (e.g., the 2nd prompt from MS-COCO), which can be attributed to the inherent randomness in the input Gaussian representation. These examples illustrate the robustness of our watermarking approach, as the visual quality of the generated images remains consistent, and the watermarking process does not interfere with the generation fidelity.
C.2 Failed Examples
We report in Table 16 the cases with the largest CLIP-Score reduction when compared to their non- watermarked counterparts. These examples represent the worst deviations observed in evaluation and were selected specifically because they exhibit the largest semantic drift under watermark injection. They primarily occur under prompts that involve extreme lighting, heavy render-like effects, or unusnally complex artistic constraints. These conditions make both inversion and generation more unstable, which amplifies small perturbations introduced by watermarking. Even in these cases, the semantic content of the prompt is generally preserved, but fine-grained structures or lighting consistency may deviate. Understanding and mitigating these extreme cases can be an interesting direction for future work.
25

---

Published in Transactions on Machine Learning Research (02/2026)
D Broader Impact Statement and Limitations
Broader Impact Statement. Our work aims to enhance the safety and accountability of diffusion-based generative models by enabling reliable watermarking. This helps detect Al-generated content, prevent misuse, and promote responsible deployment in real-world applications. DifKGW does not encode any user-specific information, ensuring that it cannot facilitate user-level tracking. While the approach improves robustness in both text-to-image and image-to-image settings, we also acknowledge that image-to-image editing may introduce ambiguity. We have highlighted this limitation and believe it represents interesting direction for future rescarch.
Limitations. Our method primarily focuses robustness against spatial perturbations (e.g., cropping, rotation) and common post-processing operations. However, it may be less effective under extreme distribution shifts or adversarial removal attacks specifically crafted to disrupt the frequency-domain signal used in watermarking. Additionally, our detection framework assumes access to a partial or full reverse diffusion process, which may not always be feasible in real-world scenarios with closod-source models.
E
GenAl Usage Disclosure
During the preparation of this manuscript, we made controlled use of large language models (LLMs), specifically ChatGPT, as an auxiliary writing tool. The LLM was used solely for stylistic refinement, such improving the fluency, grammar, and readability of paragraphs originally drafted by the authors. All scientific content, including the conceptual development, methodology, experimental design, and main narrative of the paper, was fully conceived, written, and validated by the authors without reliance on LLMs. Therefore, the LLMs served exclusively in supportive editing role.
26

---

Published in Transactions on Machine Learning Research (02/2026)
Prompt
Non- watermarked
Watermarked
portrait of girl skull face, marilyn monroe, in the style artgerm, charlie bowater, atey ghailan and mike mignola, vibrant colors and hard shadows and strong rim light, plain background, comic cover art, trending on artstation very beantiful anime cute girl, full body, long wavy blond hair, sky blue eyes, full round face, short smile, lancy top, miniskirt, front view, medium shot, mid-shot, laying in bed, highly detailed, cinematic wallpaper by Stanley Artgerm Lau overgrown foliage overtaking massive japanese temples, underwater environment,
borealis, scenery, professional, award-winning, trending on artstation, hyper detailed, realistic, beautiful, emotional, shiny, golden, picture high detail photograph of manhattan after being destroyed by an alien race, building, avenue, urban architecture, americana architecture, concrete architecture, paved roads, by thomas kinkade trending on artstation, photorealistic, wild vegetation, utopian, futuristic, blade runner digital detailed portrait of anthromorphic female hyena, in style of zootopia, fursona, furry, furaffinity, k, deviantart, wearing astronaut outfit, in style of disney zootopia, floating in space, space background, in deep space, dark background, hyena fursona, cyberpunk, female, detailed face, style of artgerm
Table 12: Stable-Diffusiin Prompts with corresponding non- watermarked and watermarked images. All images well capture the textual prompt information. Some watermarked images demonstrate slight improvements (e.g., the 5th) compared to the wateraarrdd versuus, while some show minor degradation (e.g., the 4th), attributed to the randomness inherent in the input Gaussian representation.

---

Published in Transactions on Machine Learning Research (02/2026)
Prompt
Non-watermarkedd
Watermarked
movie poster, game about deep caves and void monsters, cinematic light, clean linework, finely detailed, 4 k, trending artstation, concept art by stanley lau
a simple micro-service deployed to public cloud, security, attack vector, trending on Artstation, painting by Jules Julien, Leslie David and Lisa Frank, muted colors with minimalism
symmetry!! portrait of female sorcerer, dark fantasy, intricate, elegant, highly detailed, my rendition, digital painting, artstation, concept art, smooth, sharp focus, illustration, art by artgerm and greg rutkowski and alphonse mucha and huang guangjian and gil elvgren and sachin teng
pastel landscape of an anime field. clean sharp digital art, environment concept art, by rossdraws, ghibli, breath of the wild, greg rutkowski
tiny worlds by greg rutkowski, sung choi, mitchell mohrhauser, maciej kuciara, johnson ting, maxim verchin, peter konig, bloodborne, photorealistic, einematic lighting, hd, high details, dramatic, dark atmosphere, trending artstation
Table 13: Stable-Diffusioo Prompts with corresponding nou- non- non-watermarked and watermarked images. All images well capture the textual prompt information. Some watermarked images demonstrate slight improvements (e.g., the 2nd) compared to the non-watermarked versions, while some show minor degradation (e.g., the 3rd), attributed to the randomness inherent in the inguu Gaussian representation.

---

Published in Transactions on Machine Learning Research (02/2026)
Prompt
Realistic
Non-watermarked
Watermarked
Two bear cubs playing together in
A boat on calm water by treee
A bowl full of marshmallowe, chocolate, other delicious treats
A cat is lying covered bed with white sheets
A cute little teddy bear mantle near a vintage photo
A dog that is laying down on a bed
Table 14: MS-COCO Captions with corresponding realistic, non-watermarked, and watermarked images. All generated images capture the textual prompt information well. Some watermarked images demonstrato slight improvements (e.g., the 4-6th) compared to the non-watermarked versions, while some show minor degradation (e.g., the 1st), attributed to the randomness inherent in the input Gaussian representation.
29

---

Published in Transactions on Machine Learning Research (02/2026)
Prompt
Realistic
won-wwatrrarked
Watermarked
A quiet city street shows buildings, cars, and people
A horse with large capped mountains the
background
A living room with white sofa and gray rug
A person riding skis snowy slope
A plate of food with a fried egg and colorful vegetables
There green small boots woods
Table 15: MS-COCO Captions with corresponding realistic, non-watermarked, and watermarked images. All generated images capture the textual prompt information well. Some watermarked images demonstrate slight improvements (e.g., the 1st) compared to the non-maaermerked versions, while some show minor degradation (c.g., the 2nd), attributed to the randomness inherent in the input Gaussian representation.
30

---

Published in Transactions on Machine Learning Research (02/2026)
Prompt
Non- watermarked
Watermarked
profile portrait, helmet tiger cyberpunk made of pink lava and fire design by mark brooks and brad kunkle detailed, aurora digital package, profile portrait, cy cyberpunk fashion, realistic shaded perfect face, fine details, very dark environment, misty atmosphere, closeup, & d, fantasy, intricate, clegant, highly detailed, digital painting, artstation, concept art, matte, sharp focus, illustration, hearthstone a lighthouse space, meteors, air shot, clegant, digital painting, concept art, smooth, sharp focus, illustration, from StarCraft Ruan Jia and Mandy Jurgens and Artgerm and William- William-Adolphe
Bouguerea
portrait art of nicole aniston 8 k ultra realistic, lens flare, atmosphere, glow, detailed, intricate, full of colour, cinematic lighting, trending on artstation, 4 k, hyperrealistic, focused, extreme details, unreal engine 5, cinematic, masterpiece
Table 16: Failure cases under highly stylized prompts. These cases typically involve extreme lighting, cinematic rendering, heavy stylistic constraints, where both inversion and generation become unstable.
31


Reviews:
[{"review_id": "ndSqsvnIuw", "reviewer": "Reviewer_wv9s", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper investigates watermarking for diffusion models. Inspired by the KGW watermarking method used in Large Language Models (LLMs), the authors propose DiffKGW, a method that partitions the standard Gaussian distribution into \"Green\" and \"Red\" regions based on a secret key. The latent representations are then sampled exclusively from the Green regions. The authors theoretically show that the method preserves the Gaussian distribution of the representations. \n\nFurthermore, the paper introduces a \"unified framework\" categorizing watermarks into three dimensions: element sampling, shape design, and channel selection. Based on this framework, they implement a hybrid strategy that dynamically selects between \"Gaussian Rings\" and \"Random Gaussian\" patterns based on the sensitivity to geometric transformations. Experiments on Stable Diffusion and InstructPix2Pix demonstrate that the method achieves high visual quality and robustness against both geometric and noise-based attacks\n\nStrengths:\n- The adaptation of the discrete KGW in LLM to the continuous latent space of diffusion models is mathematically sound. The result of Lemma 1 provides a theoretical contribution that distinguishes this work from heuristic methods like Tree-Ring [1] which might distort the latnet sapce.\n- The categorization of watermarking methods into element sampling, shape design, and channel selection provides a useful taxonomy for understanding the design space of diffusion watermarking.\n- The method demonstrates strong performance across a diverse set of attacks and maintains high visual quality.\n\nWeakness:\n- The paper has limited novelty. While the distribution-preserving sampling is well-motivated, the core mechanism is a direct translation of the existing LLM KGW method into the diffusion domain. Additionally, the \"Gaussian Ring\" shape design bears significant similarity to prior works such as Tree-Ring and Ring-ID.\n- The \"Gaussian Random\" watermarking component is novel, but the ablation studies suggest limited practical impact. Table 8 shows that adding the Random Gaussian component improves the average detection rate from 0.952 (using only Gaussian Rings) to 0.984. The authors should better justify whether the complexity of the hybrid strategy is necessary, given these diminishing returns.\n\n[1] Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings watermarks: Invisible fingerprints for\ndiffusion images. Advances in Neural Information Processing Systems, 36, 2023.\n\n[2] Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. Ringid: Rethinking tree-ring watermarking for enhanced\nmulti-key identification. arXiv preprint arXiv:2404.14055, 2024.", "claims_and_evidence_yn": "Yes", "claims_explanation": "As stated in the strengths, the proposed method demonstrates an effective balance of robustness and utility. The authors support their claims with accurate theoretical and empirical evidence.", "audience_yn": "Yes", "audience_explanation": "The topic of watermarking diffusion models is critical for protecting copyright and identifying the source of inappropriate images. The proposed method offers a valuable direction for the community by successfully adapting LLM watermarking techniques to diffusion models. Furthermore, the paper provides a unified framework with three clear design principles that can effectively inspire future research.", "requested_changes": "1. The ablation study in Table 8 indicates that the \"Random Gaussian\" component provides only a marginal improvement in average detection performance compared to using Gaussian Rings alone. Given the added complexity of the hybrid channel selection strategy, please provide a stronger justification for including this component.\n\n2. In the text-to-image experiments (Table 1), the method is compared against seven baselines. However, the image-to-image section (Table 6) only compares against Tree-Ring and Gaussian Shading. Please extend the image-to-image comparison to include other relevant baselines from the T2I section (such as RivaGan and Stable Signature) to ensure consistency, or explain why they were excluded.\n\n3. Please provide an analysis of the running time (or latency) for both the embedding and extraction steps compared to key baselines. This is important to verify the practical efficiency of the proposed method.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "f1jkPrs2j0", "reviewer": "Reviewer_9EFc", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The work introduces a generalisation of the LLM KGW watermarking scheme to diffusion models.\n\nStrengths:\n- mostly clear presentation\n- elegant generalisation\n- performant scheme that maintains high fidelity\n- good evaluation of basic robustness\n\nWeaknesses:\n- unclear threat model\n- robustness evaluation should show how/when the scheme breaks, some attacks details are missing\n- attack evaluation beyond image editing (watermark destruction) missing", "claims_and_evidence_yn": "Yes", "claims_explanation": "The work provides a sufficient evidence to back up the claims of the effectiveness of the scheme in benign conditions; as well as its robustness to weak transformations (e.g. noising, compression), and one strong attacks (diffusion-based regeneration) in a limited setting.", "audience_yn": "Yes", "audience_explanation": "Identification of generative content as well as neural-based watermarking are both topics of interest to the broader machine learning and media communities. This work generalises an existing scheme for watermarking LLM generated text to image generation.", "requested_changes": "1. Watermarking as a whole is a broad field with watermarks that serve different purpose. Based on the selection of related work I can tell that the authors intend to __identify__ watermarked content. However, this should be made more explicit to avoid confusion with brittle, or attribution watermarking. In other words, you'd make the threat model more explicit.\n2. Some presentation of worst case (degenerate) examples would help the readers understand the failure modes more.\n3. It isn't clear to me how strong the diffusion-based regeneration is either -- the appendix doesn't provide details beyond citing the work. More broadly, proper robustness evaluation needs to show when a given method breaks the scheme not just that it doesn't in some arbitrary setting. E.g. blurring or noising is guaranteed to destroy the watemark if it's sufficiently strong (at the cost of image quality).\n4. As the authors noted in the evaluation, the adversarial evaluation is quite limited. I can accept that if more explicit discussion around potential attacks is provided in the main body -- the limitations discussed in the appendix are easy to miss and too abstract. See additional comments.", "broader_impact_concerns": "N/A", "additional_comments": "Evaluating diffusion-based attack is a good first towards testing the robustness of the scheme. Additional things that you can consider:\n- recovery of the ring from degenerate samples (e.g. uni colors) or from minimally edited images (e.g. in model based online image editing)\n- reuse of watermarks\n- robustness under watermark overwriting", "extra_scores": {}, "extra_text": {}}, {"review_id": "uawGoC4ybO", "reviewer": "Reviewer_5zGy", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper presents DiffKGW, a novel, training-free watermarking method for diffusion models. The core contributions are: (1) a \"unified framework\" that categorizes latent watermarking methods; (2) the generalization of the KGW watermark from LLMs to the continuous latent space of diffusion models, which aims to preserve the initial Gaussian distribution; and (3) a hybrid shape design combining \"Gaussian Ring\" and \"Random Gaussian\" methods to provide robustness against both geometric and noise-based attacks.", "claims_and_evidence_yn": "Yes", "claims_explanation": "The paper's primary claim is that DiffKGW is \"stealthy\" because it \"preserves the Gaussian distribution of [the] initial latent representation.\" The paper provides high fidelity scores (FID, CLIP-Score) to show the output image quality is high. It also provides a theoretical analysis (Lemma 1, Proposition 2). \n\nThe hybrid \"Gaussian Ring\" and \"Random Gaussian\" method is robust to a comprehensive set of attacks, including geometric (rotation) and noise-based (JPEG, blur) attacks. Table 1 shows high detection accuracy against one fixed-parameter version of each attack (e.g., \"rotation by 75 degrees,\" \"JPEG compression with a ratio of 25%\").\n\nThe paper introduces a \"unified framework\" for watermarking as a key contribution. Section 3 categorizes existing watermarking methods into three dimensions (element sampling, shape design, channel selection).", "audience_yn": "Yes", "audience_explanation": "The paper tackles provenance, copyright, and misuse of diffusion models. This is one of the most critical and high-priority \"AI safety\" and \"AI ethics\" problems currently facing the machine learning community. It directly addresses diffusion models, which remain a cutting-edge and intensely studied area of generative AI. The core idea of adapting a watermark from LLMs to the continuous latent space of diffusion models is a novel and clever contribution.", "requested_changes": "1. The current evidence for stealthiness (FID, CLIP-Score) measures image fidelity. The author should clarify the stealthiness concept in watermark, is it regarding the perceptual quality, data distribution with respect to the generated image distribution or natural image distribution? Though the author defined the watermark distribution in Proposition 2, the unit Gaussian distribution lacks clarity. \n\n2. The author proposed two ways of watermarking in different channels of the images and stated them as redundancy design. However, the empirical results didn’t show the robustness of each individual watermarking method. Can the author provide some empirical analysis of the effectiveness of the redundancy design, more specifically, is one watermark (ring) always better than the other (random)?\n\n3. The selection of the optimal watermark channel seems to be arbitrary. Can the author provide the algorithm and justification for the channel selection, some empirical analysis would be sufficient.\n\n4. Section 3 uses a unified framework in the section title may be over claim. A taxonomy or a structured literature review may be more appropriate.", "broader_impact_concerns": "1. It may enable user-level tracking without users' consent\n2. False attribution and proof of ownership due to the image-to-image watermark.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)