Spread them Apart: Towards Robust Watermarking of Generated Content

Authors: Mikhail Pautov, Danil Ivanov, Andrey V. Galichin, Oleg Rogov, Ivan Oseledets
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: data watermarking, ai safety, generative content

Abstract:
Generative models that can produce realistic images have improved significantly in recent years. The quality of the generated content has increased drastically, so sometimes it is very difficult to distinguish between the real images and the generated ones. Such an improvement comes at a price of ethical concerns about the usage of the generative models: the users of generative models can improperly claim ownership of the generated content protected by a license.  In this paper, we propose an approach to embed watermarks into the generated content to allow future detection of the generated content and identification of the user who generated it. The watermark is embedded during the inference of the model, so the proposed approach does not require the retraining of the latter. We prove that watermarks embedded are guaranteed to be robust against additive perturbations of a bounded magnitude. We apply our method to watermark diffusion models and show that it matches state-of-the-art watermarking schemes in terms of robustness to different types of synthetic watermark removal attacks.

Decision: reject
Reviewer scores: 6, 5, 3, 3, 5

Reviews and discussion:
<thread>
creation date:
1730194339340

thread_type:
official_review

<thread_object>
creator: reviewer_c9yy

<content>
summary:
A framework called “Spread them Apart” for watermarking generated content is presented, specifically targeting images produced by diffusion models.

strengths:
+ A method of embedding watermarks during the model inference phase is proposed to simultaneously detect and attribute generated images.
+ Proven robustness against bounded additive perturbations.

weaknesses:
- The expression and logic of the paper can be further improved to enhance readability. For instance, a clear explanation of "$\mathcal{L_{qual}}$​" is lacking. Additionally, there are a few typos, such as the use of "the" in line 115.

- To enhance the understanding of the paper's innovation, the authors should compare their approach with using pixel differencing in digital watermarking [1]. By highlighting the differences between the two methods, the paper can further illustrate the unique contribution and novelty of the proposed approach.

- While resilience against certain "watermark removal" attacks is demonstrated, this paper lacks consideration of the effectiveness of the proposed watermarking method against ambiguity attacks.

- The evaluation is not very convincing. It is best to supplement some experiments that include the latest methods, such as WOUAF [2].

  [1] A Robust and Computationally Efficient Digital Watermarking Technique Using Inter Block Pixel Differencing.

  [2] WOUAF: Weight Modulation for User Attribution and Fingerprinting in Text-to-Image Diffusion Models.

questions:
- The method presented in this paper cannot provide robustness against transformation attacks such as cropping and rotation. The authors claim that embedding watermarks in a local area can overcome this problem. How is this achieved?
- Can the proposed method resist watermark overwriting attacks?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730404602809

thread_type:
official_review

<thread_object>
creator: reviewer_yie4

<content>
summary:
The paper introduces an image watermark method named spread them apart. When generating images from latent $z$, the model measures the generated image to see if it satisfies the constraint $L_{wm} < \epsilon$. If the watermark doesn’t successfully embed into the image, the latent $z$ is optimized, otherwise, the image is given to the user. To decide on the threshold, the method uses double-tail detector as described [1]. To embed the watermark, the method generate a unique secret $s(u_i)$ and a watermark $w(u_i)$, then embed it on the pixel level. If the embedding is not successful, the method further fine-tunes the latent vector $z$, with a two-component loss. The paper also provides a proof of robustness against additive attacks. The experiment shows that the method demonstrates strong robustness against various watermarking removal attacks, while still maintaining high image quality.


[1] Zhengyuan Jiang, Jinghuai Zhang, and Neil Zhenqiang Gong. 2023. Evading Watermark based Detection of AI-Generated Content. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (CCS '23). Association for Computing Machinery, New York, NY, USA, 1168–1181. https://doi.org/10.1145/3576915.3623189

strengths:
1. Compared with stable signature [1] and SSL [2], the method demonstrates strong robustness against attacks like brightness, contrast shift, gamma correction, sharpening, hue, satuation adjustment, noise attack, JPEG and PGD [3].
2. The paper is well-written, and has a clear structure.

[1] Fernandez, Pierre, et al. "The stable signature: Rooting watermarks in latent diffusion models." Proceedings of the IEEE/CVF International Conference on Computer Vision. 2023.

[2] Fernandez, Pierre, et al. "Watermarking images in self-supervised latent spaces." ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2022.

[3] Mądry, Aleksander, et al. "Towards deep learning models resistant to adversarial attacks." stat 1050.9 (2017).

weaknesses:
1. The paper does not include ablation study, which is a large missing. For example, you could present the impact of different watermark length, the effect of epsilon parameter to the robustness nad visibility, the loss weight ($\lambda_{wm}$ and $\lambda_{qual}$) to the robustness and visibility. 
2. The method embeds watermark in the pixel space. The latent vector $z$ is optimized during inference to constraint the loss within the acceptable region . It seems all models that have a decoder structure can perform this method, which is pretty general, like VAE or GAN. Could the authors explain the reason why only include experiments on diffusion model? Or could the authors suggest the possible disadvantages of other types of models? Or the authors can pointing out the property that the diffusion model adapted well on their proposed method.
3. The experiment only includes stable signature and SSL as baselines, which is not comprehensively compared. Can the authors include more baselines like WOUAF [1]?
4. The optimization process introduces more computation during inference. The authors are encouraged to report the extra time used in the optimization. For example, the authors can present hte average inference time with and without watermarking, or the optimization time scales with watermark length. You could also present your computation overhead compared to other watermarking methods (baselines).

[1] Kim, C., Min, K., Patel, M., Cheng, S., & Yang, Y. (2024). Wouaf: Weight modulation for user attribution and fingerprinting in text-to-image diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (pp. 8974-8983).

questions:
1. The method embeds and extracts the watermark in a pixel-wise manner. A single pixel can be easily altered by attackers. Could you consider applying your method to block-wise areas, similar to the approach in [1]?

[1] Yang, Z., Zeng, K., Chen, K., Fang, H., Zhang, W., & Yu, N. (2024). Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (pp. 12162-12171).
</content>
</thread_object>

</thread>
<thread>
creation date:
1730591581063

thread_type:
official_review

<thread_object>
creator: reviewer_uwy1

<content>
summary:
The paper "Spread them Apart" introduces a robust watermarking technique for images generated by diffusion models, embedding watermarks directly during the generation process to prevent unauthorized removal.

strengths:
1. The watermarking method enables accurate identification of the user who sent the query, ensuring traceability.
2. The watermark minimally alters the image, maintaining high visual quality while embedding robust identifiers.

weaknesses:
1. The robustness evaluation lacks common post-generation attacks like rotation, resizing, grayscale conversion, and cropping, and examples of corrupted images are not provided.
2. The watermark embedding process increases the image generation time. The paper should provide the experiments of generation time cost.
3. Experiments assessing the impact of watermarking on image quality are limited. More quantitive metrics like PSNR should be used

questions:
See weakness
</content>
</thread_object>

</thread>
<thread>
creation date:
1730608074612

thread_type:
official_review

<thread_object>
creator: reviewer_uxyp

<content>
summary:
This paper introduces "Spread Them Apart", an in-processing watermarking algorithm that aims to achieve robust image attribution. The idea is to randomly generate n index pairs (A_i, B_i). By comparing the pixel intensities at these indexed locations, a tuple of n binary keys is established, based on the relative magnitudes of the pixel values in each pair. This tuple can then serve as a unique, verifiable identifier for the user. The proposed method demonstrates robustness against additive noise attacks within a bounded magnitude, ensuring the integrity of the watermark under various perturbations.

strengths:
This paper is well-written and easy to follow. Although the methodology itself is straightforward, it is proven to be effective and robust against simple image manipulation.

weaknesses:
The approach presented in this paper is relatively straightforward, demonstrating theoretical robustness against perturbations such as brightness adjustment, contrast shifts, and additive noise. However, its limitations are also apparent. As the authors acknowledge, the method lacks resilience against geometric distortions, which alter the image's size and indexing—common forms of attacks that the paper does not address in detail.

While the authors suggest that "this limitation can be addressed by embedding watermarks in localized areas or the frequency domain of the image," this raises the question: given these potential solutions, why these methods are not implemented in the current study? It would be insightful to understand the trade-offs here.

A further concern is the scalability of the proposed approach. The watermark retrieval process requires comparing each image against every user's secret key before generating a binary string, which appears impractical as the user base grows. This limitation suggests that, as the number of users increases, the approach may face significant challenges in maintaining efficiency and scalability.

questions:
1. In this paper, there are some constraints set in place on the attacks (i.e. L infinite norm for additive noise, etc.) To evaluate the effectiveness of these constraints, it would be helpful to include visualizations of the attacked images in the appendix. Such visual aids could convincingly illustrate the impact of these constrained attacks on image quality and watermark robustness.

2. For the "contrast -" result in Table 2, it is 0.998. This value is influenced by a negative sign introduced during processing. Given that the method employs a two-tailed detection approach, this result is indeed the optimal outcome in this context. However, a brief explanatory note could help clarify this for readers, potentially reducing confusion about the significance of the negative sign and its impact on the results.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730695182806

thread_type:
official_review

<thread_object>
creator: reviewer_mwgz

<content>
summary:
This paper proposed to watermark the images generated by latent diffusion models, for detection and attribution, where the watermark is embedded by optimizing the denoised latent representation passed to the VAE decoder of the latent diffusion model. The evaluation of the proposed watermarking method focuses on the robustness against different watermark removal attacks.

strengths:
1. The proposed watermarking method is shown to be robust against various types of removal attacks, by conducting comprehensive experiments.
2. The bound of the robustness against additive watermark removal attacks is theoretically analyzed.
3. The paper is well-written overall.

weaknesses:
1. The paper does not provide the evaluation of robustness against cropping, rotation, and translation attacks.
2. The proposed method needs 700 iterations to optimize the latent representation before generating an image, slowing down the generation speed.
3. More relevant watermarking methods should be included for comparison, for example, AquaLoRA [1].

[1] Feng, Weitao, et al. "AquaLoRA: Toward White-box Protection for Customized Stable Diffusion Models via Watermark LoRA." arXiv preprint arXiv:2405.11135 (2024).

questions:
1. Compared with the original inference process, what is the additional time cost introduced by the extra optimization process of the denoised latent vector for watermarking?
2. The paper claims that “The watermarking method does not provide robustness against cropping, rotation, and translation attacks. However, this limitation can be overcome by inserting watermarks in the localized areas or the frequency domain of the image”. Why inserting watermarks in the localized areas or the frequency domain of the image can improve the robustness against cropping, rotation, and translation attacks?
3. Is the proposed method robust to image editing attacks?
</content>
</thread_object>

</thread>


Metareview: