Title: StableGuard: Towards Unified Copyright Protection and Tamper Localization in Latent Diffusion Models
Venue: NeurIPS 2025
Accepted: yes
Keywords: Copyright protection

tampering localization

mixture-of-experts guided forensics

latent diffusion models.
Abstract: The advancement of diffusion models has enhanced the realism of AI-generated content but also raised concerns about misuse, necessitating robust copyright protection and tampering localization. Although recent methods have made progress toward unified solutions, their reliance on post hoc processing introduces considerable application inconvenience and compromises forensic reliability. We propose StableGuard, a novel framework that seamlessly integrates a binary watermark into the diffusion generation process, ensuring copyright protection and tampering localization in Latent Diffusion Models through an end-to-end design. We develop a Multiplexing Watermark VAE (MPW-VAE) by equipping a pretrained Variational Autoencoder (VAE) with a lightweight latent residual-based adapter, enabling the generation of paired watermarked and watermark-free images. These pairs, fused via random masks, create a diverse dataset for training a tampering-agnostic forensic network. To further enhance forensic synergy, we introduce a Mixture-of-Experts Guided Forensic Network (MoE-GFN) that dynamically integrates holistic watermark patterns, local tampering traces, and frequency-domain cues for precise watermark verification and tampered region detection. The MPW-VAE and MoE-GFN are jointly optimized in a self-supervised, end-to-end manner, fostering a reciprocal training between watermark embedding and forensic accuracy. Extensive experiments demonstrate that StableGuard consistently outperforms state-of-the-art methods in image fidelity, watermark verification, and tampering localization.

StableGuard: Towards Unified Copyright Protection and Tamper Localization in Latent Diffusion Models

Abstract

The advancement of diffusion models has enhanced the realism of AI-generated content but also raised concerns about misuse, necessitating robust copyright protection and tampering localization. Although recent methods have made progress toward unified solutions, their reliance on post hoc processing introduces considerable application inconvenience and compromises forensic reliability. We propose StableGuard, a novel framework that seamlessly integrates a binary watermark into the diffusion generation process, ensuring copyright protection and tampering localization in Latent Diffusion Models through an end-to-end design. We develop a Multiplexing Watermark VAE (MPW-VAE) by equipping a pretrained Variational Autoencoder (VAE) with a lightweight latent residual-based adapter, enabling the generation of paired watermarked and watermark-free images. These pairs, fused via random masks, create a diverse dataset for training a tampering-agnostic forensic network. To further enhance forensic synergy, we introduce a Mixture-ofExperts Guided Forensic Network (MoE-GFN) that dynamically integrates holistic watermark patterns, local tampering traces, and frequency-domain cues for precise watermark verification and tampered region detection. The MPW-VAE and MoEGFN are jointly optimized in a self-supervised, end-to-end manner, fostering a reciprocal training between watermark embedding and forensic accuracy. Extensive experiments demonstrate that StableGuard consistently outperforms state-of-the-art methods in image fidelity, watermark verification, and tampering localization.

1 Introduction

The unprecedented capabilities of latent diffusion models (LDMs) have revolutionized image synthesis, redefining artistic creation and visual content production [1-6]. However, as these models become more accessible, concerns over unauthorized use and malicious content tampering have intensified, necessitating solutions to safeguard intellectual property and ensure content authenticity.

Traditional copyright protection relies on watermarking techniques [7-9], which embed identifiable information into images through post-hoc processing. While effective in some cases, these methods introduce computational overhead and image degradation due to their detachment from the generative process. Recent approaches to diffusion-native watermarking integrate embedding mechanisms directly within the generation pipeline [10-14], but they fail to support advanced forensic needs

such as quantifying tampering severity or precisely localizing manipulations [15-20]. Although recent works have attempted to unify copyright protection and tampering localization in a single framework [21-23], they remain inherently post-hoc, with generation and forensics optimized independently. This decoupled optimization prevents mutual enhancement between the two tasks, thereby limiting both the overall forensic robustness and practical applicability. The absence of a seamless framework that integrates these functionalities in an LDM-native manner remains a major gap, hindering real-world deployment in security-sensitive applications.

To bridge the gap between copyright protection and content forensics in LDMs, we propose StableGuard , a unified framework that integrates holistic watermark directly into the generative process. Our core insight is twofold: (i) holistically distributed watermarks exhibit inherent robustness against localized manipulations due to spatial redundancy, and (ii) the subtle perturbations introduced by these watermarks can serve as reliable cues for tampering localization through missing feature detection. These complementary properties make holistic watermarking a compelling foundation for jointly addressing ownership verification and fine-grained forensic analysis in a unified LDM-native manner. StableGuard achieves this integration through two key components: the Multiplexing Watermark Variational Autoencoder (MPW-VAE) for embedding watermarks during generation, and the Mixture-ofExperts Guided Forensic Network (MoE-GFN) for tamper-agnostic forensic analysis. MPWVAE extends the standard LDM architecture by incorporating a trainable watermark adapter within the VAE decoder and employs a multiplexing strategy to generate both visually indistinguishable watermarked and watermarkfree images, facilitating self-supervised training

Pred.

WM.

Pred. Mask

Watermarked

image

Tampered

image

Post-hoc

Watermark

Network

Copyright

Extractor

Locator

Bit WM.

Original

image

Bit WM.

Pred.

WM.

Pred. Mask

(b) Our StableGuard

Denoising

UNet

ℰ

MPW-VAE

Watermarked

image

Image

Tampered

image

Original

image

(a) Post-hoc Methods

'a cat on the railing.'

LDM

'a cat on

the railing.'

T2I

TLE

WEE

BEE

MoE-GFN

Input

Output

Router

Gating

MoFE

Block

WM. Adapter

without manual annotations. MoE-GFN performs watermark extraction and tampering localization via a Mixture-of-Forensic-Experts (MoFE) block comprising three specialized experts: a Watermark Extraction Expert , a Tampering Localization Expert , and a Boundary Enhancement Expert . These experts are dynamically fused by a Dynamic Soft Router , allowing for precise and holistic forensic predictions. The MPW-VAE and MoE-GFN are trained jointly in an end-to-end manner, enabling mutual reinforcement between watermark embedding and forensic performance. Extensive experiments across multiple benchmarks demonstrate that StableGuard outperforms existing methods in both watermark retrieval and tampering localization, validating its effectiveness for real-world security-sensitive applications.

In summary, our main contributions are as follows:

We introduce StableGuard, a unified proactive forensics framework for LDMs, seamlessly integrating copyright protection and tampering localization into LDM-based image generation.

We propose a simple yet effective self-supervised forensic learning framework that embeds an imperceptible, holistic bit watermark via a multiplexing watermark VAE. This enables precise copyright protection and tampering localization without requiring labeled data.

We develop a tampering-agnostic mixture-of-experts forensic network that synergistically integrates holistic, subtle, and boundary features to extract forensic cues, ensuring robust watermark retrieval and precise tampering localization across various attack scenarios.

Extensive experiments demonstrate that StableGuard outperforms state-of-the-art methods in both forensic accuracy and robustness while preserving the visual fidelity of generated images.

2 Related Work

2.1 Image Watermark

Image watermarking has long served as a foundational technique for intellectual property protection [24-28]. Traditional approaches typically rely on encoder and decoder architectures [7, 8], flow-based models [21, 29], or per-image encoding strategies [7, 30]. These methods are often implemented as separate steganographic modules applied after image generation, introducing additional processing overhead and potential degradation in visual quality. In parallel, diffusion models, particularly latent diffusion models (LDMs), have recently achieved remarkable progress across diverse domains [1, 2, 31-35]. Motivated by this success, recent studies have explored embedding watermarks directly into the generative process [10-12, 14, 36]. For example, Tree-Ring [36] modifies the initial noise vector, CRoSS [14] employs image-to-image steganography, and methods such as Stable Signature [10], WOUAF [11], and WaDiff [12] fine-tune LDMs to embed watermarks in latent space. While these LDM-native approaches improve integration and visual fidelity, they generally neglect tampering localization-a key aspect for assessing manipulation severity and enabling forensic content reuse. Our work introduces a unified framework that jointly addresses copyright protection and tampering localization in LDMs, leveraging mutual optimization between watermark and forensic analysis to deliver robust, high-fidelity image forensics.

2.2 Tampering Localization

Tampering localization aims to detect and localize manipulated regions, crucial for verifying image authenticity and quantifying alterations [15-21, 37, 38]. Existing methods fall into two broad categories: passive detection and proactive defense. Passive methods rely solely on visual artifacts. For instance, MVSSNet [15] captures boundary inconsistencies, IML-ViT [16] extracts multi-scale features via a transformer backbone, and PSCC-Net [17], ObjectFormer [18], and HDF-Net [19] enhance spatial awareness using complementary cues. However, these approaches often require paired supervision and struggle to generalize across manipulation types. Proactive defenses embed auxiliary signals into the image to aid future tamper detection. Traditional fragile watermark offers blocklevel localization but lacks adaptability [39-43]. Recent methods like MaLP [44], EditGuard [21], OmniGuard [22] and WAM [23] use learned templates or invertible flows to embed watermarks for both copyright and localization. Other approaches [45, 46] explore semi-supervised tampering localization, offering post-hoc forensic analysis without prior watermarking. Despite their advantages, these post-hoc designs require external embedding networks, introduce application complexity, and are prone to quality degradation, especially for LDM-generated content. Moreover, methods like EditGuard and OmniGuard rely on reference images [21, 22], making them sensitive to auxiliary input quality. In contrast, our proposed StableGuard integrates watermark directly into the LDM process, eliminating the need for post-processing. This diffusion-native approach unifies copyright protection and tampering localization within a single, end-to-end framework where both tasks reinforce one another.

3 Proposed Method

3.1 Preliminaries of Latent Diffusion Models

Latent Diffusion Models (LDMs) are a class of generative models that synthesize images by iterative denoising a latent representation [1-5]. Unlike conventional diffusion models [47, 48] that operate in pixel space, LDMs first encode images into a lower-dimensional latent space, enabling more efficient training and inference while preserving image fidelity. The generative process begins by sampling a latent vector z T ∼ N (0 , I ) , which is progressively denoised through the recurrence:

where z t is the latent at timestep t , α t is the noise schedule, and ¯ α t = ∏ t s =1 α s . The model glyph[epsilon1] θ predicts the added noise at each step. This iterative refinement continues until the clean latent z 0 is recovered. Finally, z 0 is decoded into image space via a VAE decoder:

Multiplexing Watermark VAE

(MPW-VAE)

Mixture-of-Experts Guided Forensic Network

(MoE-GFN)

𝑀

𝑀 ෡

Enc. Block

WM.  Adapter

Stem

Res. Block

MoFE Block

Forensic

Decoder

Dec. Block

(a) Overall framework

Predicted

Watermark

Predicted

Mask

FC

Conv.

Convolutional Layer

Trainable

Freeze

Fully Connected Layer

Embedded Watermark

𝑀⨀𝑋 ෠

ሺ

1

െ𝑀ሻ⨀𝑌

Watermarked

Tampered

Image

…

…

𝑋

𝑌

𝑋 ෠

𝑌 ෠

Tampering

Localization

Expert

Boundary

Enhancement

Expert

𝑥௦௨௕

Amplitude & Phase

𝑥ிி்

𝑥௧௔௠௣

𝑥௕௢௨௡ௗ

FFT

Watermark

Extraction

Expert

𝑥௙௟௔௧

𝑥௪௠

Sub

Sub-Patch Partition

𝑥௧௔௠௣

𝑥௕௢௨௡ௗ

𝑥௪௠

Gating

Gating

Dynamic Soft

Router

𝑥௨௡௜௙௜௘ௗ

MLP

(c) Mixture-of-Forensic-Experts Block

(MoFE Block)

Residual Block

FFT

Fast Fourier Transform

Random Splicing

Input

Reshape

&

Upsample

C

Conv.

Conv.

FC

FC

Output

Input

(b) Residual-based Watermark Adapter

Embedded WM

010110101

Concat. WM

WM Output

Gating

Input features

𝑥

Input features

𝑥

中

中

中

W

0

1

0

1

1

0

1

0

1

3.2 Overview

To enable imperceptible watermark embedding and robust forensic analysis within LDMs, we propose StableGuard, a unified framework for copyright protection and tampering localization that integrates seamlessly into the LDM pipeline. As illustrated in Fig. 2, StableGuard consists of two core components: the Multiplexing Watermark VAE (MPW-VAE) and the Mixture-of-Experts Guided Forensic Network (MoE-GFN) . MPW-VAE introduces a hierarchy of lightweight, latent residual-based watermark adapters into the LDM's VAE decoder, enabling holistic binary watermark embedding while preserving perceptual fidelity. Crucially, watermark adapters can be toggled on or off, facilitating the generation of paired watermarked and clean samples from shared latent, supporting fully self-supervised training of the forensic module. For downstream analysis, MoE-GFN leverages the subtle perturbations introduced by the watermark to perform both extraction and tampering localization. Central to this network is the Mixture-of-Forensic-Experts (MoFE) Block , comprising three expert branches specialized in capturing complementary forensic cues. Their outputs are adaptively fused through a dynamic soft routing mechanism, allowing the network to selectively emphasize relevant features and achieve robust, accurate forensic predictions.

3.3 Multiplexing Watermark VAE

Most existing passive tampering localization methods depend on manually annotated masks for supervised learning, which is not only labor-intensive but also exhibits poor generalization across diverse manipulation scenarios [15-19]. To address these challenges, we propose the MPW-VAE, which incorporates a togglable lightweight watermark injection branch into a pre-trained LDM VAE decoder. This multiplexing design enables the generation of visually indistinguishable watermarked and watermark-free image pairs from the same latent input, providing a scalable foundation for self-supervised learning in forensic tasks.

To preserve visual fidelity, watermark embedding is achieved through latent residual-based adapters inserted after each block of the V AE decoder. Each adapter encodes the watermark via two fully connected layers, reshapes the embedding to match the feature dimensions, and concatenates it with the decoder features. The fused features are then processed through two convolutional blocks, followed by a residual connection to the input. This design ensures coherent and unobtrusive watermark integration (see Fig. 2(b)). Leveraging this residual mechanism, MPW-VAE produces watermarked images with imperceptible yet traceable watermark signals, while maintaining high visual similarity to the watermark-free outputs generated by the original decoder.

To simulate diverse and realistic tampering scenarios, we synthesize training samples by randomly fusing watermarked images Y with their watermark-free counterparts, either the V AE-reconstructed image ˆ X or the original image X , using a random binary mask M :

where ˆ Y denotes the synthesized training image, and p controls whether the spliced region is drawn from the VAE reconstruction or the original image. Specifically, we use X (a real image) simulates human-made manipulations produced by editing tools (e.g., Photoshop), while using ˆ X (the vanilla LDM VAE reconstruction) emulates AI-generated forgeries increasingly common with generative models. To diversify tampering patterns, we adopt a hybrid masking strategy: with 50% probability, we apply random binary masks; otherwise, we use semantic masks drawn from a pool of SAM-generated segmentations [49]. These SAM-based masks are non-image-paired, ensuring shape diversity without extra supervision. This augmentation strategy enables the network to learn to distinguish watermarked from non-watermarked regions in a self-supervised manner, thereby supporting robust joint learning of watermark extraction and tampering localization.

3.4 Mixture-of-Experts Guided Forensic Network

The embedding of holistic watermarks into generated images enables not only robust watermark verification but also tampering localization by identifying disruptions in the underlying perturbation patterns. To effectively harness the synergy between these two tasks, we propose the Mixture-ofExperts Guided Forensic Network (MoE-GFN). Inspired by the mixture-of-experts paradigm [50], MoE-GFN integrates task-specialized modules to enhance forensic performance through collaborative feature modeling. As illustrated in Fig. 2(a), MoE-GFN adopts a UNet-based architecture[51], where the decoder is augmented with a Mixture-of-Forensic-Experts (MoFE) Block (Fig. 2(c)). This block comprises three dedicated experts-Watermark Extraction, Tampering Localization, and Boundary Enhancement-each designed to capture complementary forensic cues. Their outputs are fused via a Dynamic Soft Router, which adaptively integrates task-relevant features based on the input. The complete pipeline includes a Stem module[52] for dimensionality reduction, a UNet backbone for multi-scale feature extraction, and a Forensic Decoder for final prediction.

Watermark Extraction Expert. To recover globally embedded watermarks even under local modifications, we employ a transformer-based expert that captures long-range dependencies. By modeling global correlations, this module provides robust watermark reconstruction and indirectly facilitates tampering localization by highlighting regions where watermark patterns are missing. Given input features x ∈ R b,c,h,w , we reshape them to x flat ∈ R b,hw,c and process them through a linear projection (Proj), followed by Multi-Head Self-Attention (MHSA) and a Feed-Forward Network (FFN) [53]. The final output is computed with residual addition:

Tampering Localization Expert. In contrast to watermark extraction, tampering localization demands sensitivity to subtle, local inconsistencies. To this end, we propose a sub-patch transformer that partitions feature maps into smaller patches and applies localized attention to enhance the detection of fine-grained manipulation artifacts. Formally, the input x is partitioned into n × n patches and reshaped to x sub ∈ R b · hw n 2 ,n 2 ,c . It is then processed as:

Boundary Enhancement Expert. To further refine tampering boundaries, we incorporate frequencydomain cues through a Boundary Enhancement Expert, which highlights high-frequency components

indicative of manipulation edges. This expert applies a transformer in the Fourier domain to capture boundary-specific anomalies that may be missed in the spatial domain. Given input x , we compute its Fourier transform, reshape the frequency representation, and process it through transformer layers before applying the inverse transform:

where FFT and iFFT denote the Fourier transform and inverse Fourier transform, respectively.

Dynamic Soft Router. To adaptively fuse the outputs of the three expert branches, we introduce a Dynamic Soft Router, which predicts expert-specific fusion weights conditioned on the input. This mechanism enables MoE-GFN to dynamically modulate its focus based on the type and spatial characteristics of the tampering. Given a shared input feature map x , the router generates soft weights R = Softmax ( f ( x )) , where f ( · ) is a lightweight multi-layer perceptron. The unified forensic representation is computed as a weighted sum:

By enabling input-adaptive feature integration, the Dynamic Soft Router enhances the model's ability to generalize across diverse manipulation patterns, yielding more resilient forensic predictions.

3.5 Loss Function

StableGuard is trained in a fully self-supervised, end-to-end manner, enabling mutual enhancement between watermark embedding and its watermark extraction and tampering localization tasks. During MPW-VAE training, we freeze the parameters of the pre-trained LDM VAE decoder and update only the watermark adapter. This strategy ensures high perceptual fidelity between the original and watermarked images while effectively encoding watermark information. The total training objective comprises three components: a similarity loss to maintain image quality, a watermark loss to ensure accurate extraction, and a tampering loss to localize manipulated regions precisely.

Similarity Loss. To preserve visual consistency between the watermarked image Y and the reconstructed watermark-free image ˆ X , we combine L1 distance with perceptual similarity [54]:

Watermark Loss. We supervise watermark extraction using a binary cross-entropy loss:

where W and ˆ W are the ground truth and predicted watermark bits, and L is the total bit length.

Tampering Loss. To achieve precise localization of tampered regions, we combine weighted binary cross-entropy (WBCE) with Dice loss [55]:

where M and ˆ M denote the ground truth and predicted tampering masks, σ is the sigmoid function, N is the total number of pixels, i, j are the pixel indices, and λ 1 , λ 2 are weighting factors for foreground and background.

Total Loss. The final training objective for the StableGuard framework is defined as:

'A dragon perched

atop a mountain

peak.'

'A colorful hot air

balloon floating over

a mountain range.'

Prompt

Original image

EditGuard

OmniGuard

WAM

4 Experiments

4.1 Settings

Datasets. We train StableGuard on the COCO training set [56] in a fully self-supervised manner, without requiring any manual tampering annotations. For evaluation, watermark extraction is tested on both the COCO test set and a custom text-to-image (T2I) dataset, measuring performance on real and LDM-generated content. To assess tampering localization, we focus on robustness against AI-generated manipulations using a large-scale AIGC benchmark of 35,000 images-25,000 from COCO and 10,000 from T2I dataset. Semantic masks are generated with SAM [49], followed by region edits using Stable Diffusion [1], SDXL [2], Kandinsky [57], ControlNet [4], and LaMa [58]. Further details are provided in the Appendices.

Implementation Details. StableGuard is implemented in PyTorch, built upon Stable Diffusion 2.1 1 . During training, we freeze the base model and optimize only the Watermark Adapter and MoE-GFN using the Adam optimizer [59] with a learning rate of 1 × 10 -4 . All experiments are run for 10 epochs on two NVIDIA RTX 4090D GPUs with a batch size of 16. The tampering localization expert operates on sub-patches of size n = 8 . Loss weights are set as λ 0 = 0 . 2 (Eq. (10)), λ 1 = 2 , and λ 2 = 0 . 5 (Eq. (11)).

4.2 Comparison on Watermarking

The effectiveness of our proposed StableGuard for watermark embedding and extraction is validated by experiments on two datasets: the COCO dataset and the T2I dataset. To intuitively demonstrate StableGuard's watermark injection capability, we showcase two watermark embedding examples from the T2I dataset and compare with three post-hoc watermarking methods [21-23] in Fig. 3. The corresponding prompts for generating images are 'A dragon perched atop a mountain peak' and 'A colorful hot air balloon floating over a mountain range' , respectively. As observed, the images before and after watermark embedding exhibit high visual consistency, with pixel-wise differences at a negligible level. The difference maps reveal globally distributed pixels across the entire image, demonstrating that StableGuard indeed effectively embeds holistic imperceptible watermarks while maintaining high-fidelity image generation results.

We also quantitatively compare the performance of StableGuard with eight state-of-the-art watermarking techniques under different watermark bit lengths (B.L.). The compared methods include five post-hoc watermarking approaches: HiDDeN [7], SepMark [8], EditGuard [21], OmniGuard [22] and WAM [23], as well as three diffusion-based methods: Stable Signature [10], WOUAF [11], and WaDiff [12]. As shown in Tab. 1, our approach maintains competitive with existing solutions on effectively preserving the perceptual quality of the original content after watermark embedding, where the embedded images exhibit close visual similarity with their non-watermarked counterparts.

(a)

(b)

(c)

(d)

(e)

(f)

(g)

(h)

(i)

(j)

(k)

(l)

(m)

Meanwhile, the accuracy of the watermark extracted from these images consistently outperforms existing techniques.

Unlike conventional post-hoc approaches, our method is seamlessly integrated into the LDM generation pipeline, exploiting an end-to-end model to directly embed watermarks into generated images. Furthermore, compared to those diffusion-native watermarking methods, our tailored MPW-VAE employs a latent residual-based watermark adapter after the VAE decoder block, which is jointly trained with the forensics tasks, thus achieving adaptive holistic watermark injection while minimally altering the original image content.

4.3 Comparison on Tampering Localization

The quantitative results of various methods on the AIGC tampering dataset are presented in Tab. 2. As shown, existing passive localization techniques exhibit notably inferior performance when compared to StableGuard, highlighting their inability to effectively detect the latest AIGC tampering methods. In contrast, StableGuard demonstrates robust detection capabilities across a range of AIGC tampering techniques, validating the effectiveness of our approach. When compared to EditGuard, OmniGuard and WAM, StableGuard outperforms them on most metrics. This improvement is a direct result of StableGuard's design, which integrates the unique characteristics of both watermarking and tampering detection. Unlike other methods, which identify tampered regions by detecting anomalies

in image-based positional watermarks, StableGuard adopts a more precise method for tampering localization.

We also compare the tampering localization maps generated by different methods, as shown in Fig. 4. As illustrated, StableGuard consistently achieves superior tampering detection accuracy compared to other methods. This is largely attributed to the self-supervised tampering detection framework we developed, which incorporates holistic watermarks through our MPW-VAE. This framework allows the forensic model to effectively differentiate between watermarked and non-watermarked regions. Moreover, the MoE-GFN we designed plays a pivotal role in extracting and fusing diverse forensic features, further enhancing the accuracy of tampering localization.

4.4 Robustness Analysis

To assess robustness against image degradations, we evaluate StableGuard on the AIGC tampering dataset under Gaussian noise, JPEG compression, and Poisson noise, following the protocol of prior works [19, 21, 22]. As shown in Tab. 3, StableGuard consistently outperforms competing methods, maintaining strong watermark extraction and tampering localization under all conditions. This robustness stems from our holistic watermark embedding strategy and the MoE-guided forensic network, which distributes watermark signals throughout the image and adaptively integrates diverse forensic cues. These results highlight StableGuard's strong potential for practical deployment.

4.5 Ablation Study

We conduct a comprehensive ablation study to evaluate the contributions of our core components: MPW-VAE, the MoE-GFN architecture, and the joint optimization strategy.

Effectiveness of MPW-VAE. To assess MPW-VAE's impact on tampering localization, we replace it with WOUAF [11], a state-of-the-art post-hoc watermarking method. Using WOUAF, we generate watermarked images (via Eq. (3)) and train MoE-GFN for tampering localization. As shown in Tab. 4 (w/o MPW-VAE), performance degrades substantially. This gap stems from two key advantages of MPW-VAE: 1) its diffusion-native, residual-based watermarking enables high-fidelity paired image generation, which significantly benefits forensic training; and 2) joint optimization with the forensic network creates a synergistic effect, enhancing both watermark embedding and tampering detection.

Effectiveness of MoE-GFN Components. We evaluate various architectural variants of MoEGFN. Removing the entire MoFE block (w/o MoFE) and reverting to a plain UNet leads to subpar performance due to the lack of expert-driven feature extraction. Excluding individual experts-Watermark Extraction (w/o WEE), Tampering Localization (w/o TLE), or Boundary Enhancement (w/o BEE)-each results in notable performance drops, confirming their complementary roles

in capturing global watermark signals, local manipulations, and boundary refinements, respectively. Replacing the Dynamic Soft Router(w/o DSR) with simple feature summation further degrades performance, highlighting its importance in adaptively fusing expert outputs based on input-specific forensic cues. While the removal of single experts (rows 3-5 in Tab. 4) leads to only modest declines in F1, AUC, IoU, and Bit Accuracy, this stems from the model operating near a performance ceiling, where marginal contributions appear limited in isolation. Crucially, the sharp performance drop when removing the entire MoFE block (row 2) highlights that these experts are complementary rather than redundant: their integration is essential for robustness and accuracy.

We also explore the placement of the MoFE block within the UNet. Placing it in the encoder (Enc) improves localization but increases computational cost and underperforms compared to the decoder placement. Using MoFE in both encoder and decoder (Enc & Dec) yields marginal gains but at the expense of significantly higher complexity. Thus, placing the MoFE block in the decoder (Dec) strikes the best balance between performance and efficiency.

Effectiveness of Joint Optimization Strategy. To isolate the benefit of joint self-supervised optimization, we compare StableGuard with a variant where watermark embedding/extraction and tampering localization are trained separately. Results in Tab. 4 (w/o JOS) show that decoupled training leads to weaker localization. In contrast, our unified optimization promotes stronger interaction between the embedding and forensic tasks, yielding consistent watermarks that enhance localization precision.

5 Conclusion

In this paper, we introduce StableGuard, a unified framework for copyright protection and tampering localization in the context of LDMs. By injecting a global watermark during the diffusion process and leveraging its intrinsic perturbation patterns, StableGuard achieves reliable and robust watermark extraction and tampering localization simultaneously. At the core of our method is the Multiplexing Watermark VAE (MPW-VAE), which generates visually consistent paired watermarked and watermark-free images to facilitate self-supervised training of the Mixture-of-Experts Guided Forensic Network (MoE-GFN). This network is composed of specialized experts that handle holistic watermark analysis, subtle artifact recognition, and boundary transition detection, with the Mixture-of-Forensic-Experts (MoFE) block ensuring precise and efficient forensic analysis. Extensive experimental evaluations validate StableGuard's superior performance, demonstrating its effectiveness and adaptability across a wide range of image scenarios, and highlighting its potential to advance both watermarking and tamper localization in diffusion models.

Acknowledgement. This research is supported by the 'Leading Talent" under Guangdong Special Support Program (2024TX08X048), China National Key R&D Program (2024YFB4709200), KeyArea Research and Development Program of Guangzhou City (No.2023B01J0022), Guangdong Provincial Natural Science Foundation for Outstanding Youth Team Project (No. 2024B1515040010), NSFC Key Project (No. U23A20391), Guangdong Basic and Applied Basic Research Foundation (No. 2023B1515120058), Guangdong Natural Science Funds for Distinguished Young Scholars (Grant 2023B1515020097), the GuangDong Basic and Applied Basic Research Foundation (2025A1515010124), the National Research Foundation Singapore under the AI Singapore Programme (AISG Award No: AISG4-TC-2025-018-SGKR), and the Lee Kong Chian Fellowships.

References

Rombach, R., A. Blattmann, D. Lorenz, et al. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 10684-10695. 2022.

Podell, D., Z. English, K. Lacey, et al. Sdxl: Improving latent diffusion models for high-resolution image synthesis. arXiv preprint arXiv:2307.01952 , 2023.

Huang, Y., J. Huang, Y. Liu, et al. Diffusion model-based image editing: A survey. arXiv preprint arXiv:2402.17525 , 2024.

Zhang, L., A. Rao, M. Agrawala. Adding conditional control to text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 3836-3847. 2023.

Yu, Y., B. Liu, C. Zheng, et al. Beyond textual constraints: Learning novel diffusion conditions with fewer examples. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 7109-7118. 2024.

Ren, J., W. Li, Z. Wang, et al. Turbo2k: Towards ultra-efficient and high-quality 2k video synthesis. In Proceedings of the IEEE/CVF International Conference on Computer Vision . 2025.

Zhu, J., R. Kaplan, J. Johnson, et al. Hidden: Hiding data with deep networks. In ECCV , pages 682-697. 2018.

Wu, X., X. Liao, B. Ou. Sepmark: Deep separable watermarking for unified source tracing and deepfake detection. In Proceedings of the 31st ACM International Conference on Multimedia , pages 1190-1201. 2023.

Tang, W., B. Li, S. Tan, et al. Cnn-based adversarial embedding for image steganography. IEEE Transactions on Information Forensics and Security , 14(8):2074-2087, 2019.

Fernandez, P., G. Couairon, H. Jégou, et al. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 2246622477. 2023.

Kim, C., K. Min, M. Patel, et al. Wouaf: Weight modulation for user attribution and fingerprinting in text-to-image diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 8974-8983. 2024.

Min, R., S. Li, H. Chen, et al. A watermark-conditioned diffusion model for ip protection. In European Conference on Computer Vision , pages 104-120. Springer, 2024.

Wen, Y., J. Kirchenbauer, J. Geiping, et al. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust. arXiv preprint arXiv:2305.20030 , 2023.

Yu, J., X. Zhang, Y. Xu, et al. Cross: Diffusion model makes controllable, robust and secure image steganography. Advances in Neural Information Processing Systems , 36, 2024.

Dong, C., X. Chen, R. Hu, et al. Mvss-net: Multi-view multi-scale supervised networks for image manipulation detection. IEEE Transactions on Pattern Analysis and Machine Intelligence , 45(3):35393553, 2022.

Ma, X., B. Du, X. Liu, et al. Iml-vit: Image manipulation localization by vision transformer. arXiv preprint arXiv:2307.14863 , 2023.

Liu, X., Y. Liu, J. Chen, et al. Pscc-net: Progressive spatio-channel correlation network for image manipulation detection and localization. IEEE Transactions on Circuits and Systems for Video Technology , 32(11):7505-7517, 2022.

Wang, J., Z. Wu, J. Chen, et al. Objectformer for image manipulation detection and localization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 2364-2373. 2022.

Han, R., X. Wang, N. Bai, et al. Hdf-net: Capturing homogeny difference features to localize the tampered image. IEEE Transactions on Pattern Analysis and Machine Intelligence , 2024.

Zhuang, P., H. Li, S. Tan, et al. Image tampering localization using a dense fully convolutional network. IEEE Transactions on Information Forensics and Security , 16:2986-2999, 2021.

Zhang, X., R. Li, J. Yu, et al. Editguard: Versatile image watermarking for tamper localization and copyright protection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 11964-11974. 2024.

Zhang, X., Z. Tang, Z. Xu, et al. Omniguard: Hybrid manipulation localization via augmented versatile deep image watermarking. arXiv preprint arXiv:2412.01615 , 2024.

Sander, T., P. Fernandez, A. O. Durmus, et al. Watermark anything with localized messages. In The Thirteenth International Conference on Learning Representations . 2025.

Li, Y., H. Wang, M. Barni. A survey of deep neural network watermarking techniques. Neurocomputing , 461:171-193, 2021.

Zhang, J., D. Chen, J. Liao, et al. Deep model intellectual property protection via deep watermarking. IEEE Transactions on Pattern Analysis and Machine Intelligence , 44(8):4005-4020, 2021.

Yan, F., H. Huang, X. Yu. A multiwatermarking scheme for verifying medical image integrity and authenticity in the internet of medical things. IEEE Transactions on Industrial Informatics , 18(12):88858894, 2022.

Wu, H., G. Liu, Y. Yao, et al. Watermarking neural networks with watermarked images. IEEE Transactions on Circuits and Systems for Video Technology , 31(7):2591-2601, 2020.

Yang, H., X. Xu, C. Xu, et al. G2face: High-fidelity reversible face anonymization via generative and geometric priors. IEEE Transactions on Information Forensics and Security , 2024.

Fang, H., Y. Qiu, K. Chen, et al. Flow-based robust watermarking with invertible noise layer for black-box distortions. In Proceedings of the AAAI conference on artificial intelligence , 4, pages 5054-5061. 2023.

Fernandez, P., A. Sablayrolles, T. Furon, et al. Watermarking images in self-supervised latent spaces. In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages 3054-3058. IEEE, 2022.

Liu, B., Y. Yu, X. Xu, et al. Genpoly: Learning generalized and tessellated shape priors via 3d polymorphic evolving. IEEE Transactions on Pattern Analysis and Machine Intelligence , 2025.

Huang, Z., X. Xu, C. Xu, et al. Beat-it: Beat-synchronized multi-condition 3d dance generation. In European conference on computer vision , pages 273-290. Springer, 2024.

Yang, Y., Z. Huang, C. Xu, et al. Lagrangian motion fields for long-term motion generation. arXiv preprint arXiv:2409.01522 , 2024.

Huang, Z., Y. Zhou, X. Xu, et al. Think2sing: Orchestrating structured motion subtitles for singing-driven 3d head animation. arXiv preprint arXiv:2509.02278 , 2025.

Yang, H., W. Chen, X. Xu, et al. Starpose: 3d human pose estimation via spatial-temporal autoregressive diffusion. IEEE Transactions on Circuits and Systems for Video Technology , 2025.

Wen, Y., J. Kirchenbauer, J. Geiping, et al. Tree-rings watermarks: Invisible fingerprints for diffusion images. Advances in Neural Information Processing Systems , 36, 2024.

Zhuang, P., H. Li, R. Yang, et al. Reloc: A restoration-assisted framework for robust image tampering localization. IEEE Transactions on Information Forensics and Security , 2023.

Peng, R., S. Tan, X. Mo, et al. Employing reinforcement learning to construct a decision-making environment for image forgery localization. IEEE Transactions on Information Forensics and Security , 2024.

Cheng, B., R. Ni, Y. Zhao. A refining localization watermarking for image tamper detection and recovery. In 2012 IEEE 11th International Conference on Signal Processing , vol. 2, pages 984-988. IEEE, 2012.

Hurrah, N. N., S. A. Parah, N. A. Loan, et al. Dual watermarking framework for privacy protection and content authentication of multimedia. Future generation computer Systems , 94:654-673, 2019.

Kamili, A., N. N. Hurrah, S. A. Parah, et al. Dwfcat: Dual watermarking framework for industrial image authentication and tamper localization. IEEE Transactions on Industrial Informatics , 17(7):5108-5117, 2020.

Asnani, V., X. Yin, T. Hassner, et al. Proactive image manipulation detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 15386-15395. 2022.

Asnani, V., A. Kumar, S. You, et al. Probed: Proactive object detection wrapper. Advances in Neural Information Processing Systems , 36:77993-78005, 2023.

Asnani, V., X. Yin, T. Hassner, et al. Malp: Manipulation localization using a proactive scheme. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 1234312352. 2023.

Zhai, Y., T. Luan, D. Doermann, et al. Towards generic image manipulation detection with weaklysupervised self-consistency learning. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 22390-22400. 2023.

Zhang, Z., M. Li, X. Li, et al. Image manipulation detection with implicit neural representation and limited supervision. In European Conference on Computer Vision , pages 255-273. Springer, 2024.

Ho, J., A. Jain, P. Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems , 33:6840-6851, 2020.

Song, J., C. Meng, S. Ermon. Denoising diffusion implicit models. In International Conference on Learning Representations . 2021.

Kirillov, A., E. Mintun, N. Ravi, et al. Segment anything. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 4015-4026. 2023.

Jacobs, R. A., M. I. Jordan, S. J. Nowlan, et al. Adaptive mixtures of local experts. Neural computation , 3(1):79-87, 1991.

Ronneberger, O., P. Fischer, T. Brox. U-net: Convolutional networks for biomedical image segmentation. In Medical image computing and computer-assisted intervention-MICCAI 2015: 18th international conference, Munich, Germany, October 5-9, 2015, proceedings, part III 18 , pages 234-241. Springer, 2015.

Zhao, Y., W. Lv, S. Xu, et al. Detrs beat yolos on real-time object detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 16965-16974. 2024.

Vaswani, A. Attention is all you need. Advances in Neural Information Processing Systems , 2017.

Zhang, R., P. Isola, A. A. Efros, et al. The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 586-595. 2018.

Milletari, F., N. Navab, S.-A. Ahmadi. V-net: Fully convolutional neural networks for volumetric medical image segmentation. In 2016 fourth international conference on 3D vision (3DV) , pages 565-571. Ieee, 2016.

Lin, T.-Y., M. Maire, S. Belongie, et al. Microsoft coco: Common objects in context. In Computer Vision-ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13 , pages 740-755. Springer, 2014.

Razzhigaev, A., A. Shakhmatov, A. Maltseva, et al. Kandinsky: an improved text-to-image synthesis with image prior and latent diffusion. arXiv preprint arXiv:2310.03502 , 2023.

Suvorov, R., E. Logacheva, A. Mashikhin, et al. Resolution-robust large mask inpainting with fourier convolutions. In Proceedings of the IEEE/CVF winter conference on applications of computer vision , pages 2149-2159. 2022.

Kingma, D. P., J. Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 , 2014.

Wang, Z., A. C. Bovik, H. R. Sheikh, et al. Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing , 13(4):600-612, 2004.

Heusel, M., H. Ramsauer, T. Unterthiner, et al. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems , 30, 2017.

Dong, J., W. Wang, T. Tan. Casia image tampering detection evaluation database. In 2013 IEEE China summit and international conference on signal and information processing , pages 422-426. IEEE, 2013.

Guan, H., M. Kozak, E. Robertson, et al. Mfc datasets: Large-scale benchmark datasets for media forensic challenge evaluation. In 2019 IEEE Winter Applications of Computer Vision Workshops (WACVW) , pages 63-72. IEEE, 2019.

Hsu, Y.-F., S.-F. Chang. Detecting image splicing using geometry invariants and camera characteristics consistency. In 2006 IEEE International Conference on Multimedia and Expo , pages 549-552. IEEE, 2006.

Wen, B., Y. Zhu, R. Subramanian, et al. Coverage-a novel database for copy-move forgery detection. In 2016 IEEE international conference on image processing (ICIP) , pages 161-165. IEEE, 2016.

Guillaro, F., D. Cozzolino, A. Sud, et al. Trufor: Leveraging all-round clues for trustworthy image forgery detection and localization. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 20606-20615. 2023.

Zhou, J., X. Ma, X. Du, et al. Pre-training-free image manipulation localization through non-mutually exclusive contrastive learning. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 22346-22356. 2023.

Novozamsky, A., B. Mahdian, S. Saic. Imd2020: A large-scale annotated dataset tailored for detecting manipulated images. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision Workshops , pages 71-80. 2020.

Wu, Y., W. AbdAlmageed, P. Natarajan. Mantra-net: Manipulation tracing network for detection and localization of image forgeries with anomalous features. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 9543-9552. 2019.

Hu, X., Z. Zhang, Z. Jiang, et al. Span: Spatial pyramid attention network for image manipulation localization. In Computer Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XXI 16 , pages 312-328. Springer, 2020.

Kwon, M.-J., S.-H. Nam, I.-J. Yu, et al. Learning jpeg compression artifacts for image manipulation detection and localization. International Journal of Computer Vision , 130(8):1875-1895, 2022.

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: The abstract and introduction clearly state the contributions made in the paper.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: The limitations are discussed in the appendix.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory assumptions and proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [NA]

Justification: This paper does not include theoretical results.

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental result reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: The paper describes the reproduction details and the code is available.

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [Yes]

Justification: The code is available at https://github.com/Harxis/StableGuard . Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental setting/details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: The paper presents detailed experimental details.

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment statistical significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [No]

Justification: The paper does not report the statistical significance of the experiments.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments compute resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: The paper introduces the hardware platform and training duration of the experiment.

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code of ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: The paper complies with the NeurIPS Code of Ethics.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [NA]

Justification: The paper does not involve potential positive societal impacts and negative societal impacts.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: The paper poses no such risks.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: The paper has appropriate citations to the models and data sources used.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [NA]

Justification: The paper does not release new assets.

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and research with human subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional review board (IRB) approvals or equivalent for research with human subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects. Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

16. Declaration of LLM usage

Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.

Answer: [NA]

Justification: The core method development in this research does not involve LLMs as any important, original, or non-standard components.

Guidelines:

The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.

Please refer to our LLM policy ( https://neurips.cc/Conferences/2025/LLM ) for what should or should not be described.

A Problem Definition

Our goal is to imprint an imperceptible holistic watermark W during the generation process of a latent diffusion model for an image X , and comprehensively leverage the intrinsic patterns of this watermark to achieve reliable and robust copyright protection and tampering localization within a unified framework. Let the LDMs follow a generative process parameterized by G φ . The watermark embedding task can then be formulated as:

where G φ represents the LDM-based image generation function, and z is the latent input. The embedded watermark W remains imperceptible yet robust against various tampering manipulations T , such as copy-paste or splicing.

To detect tampering and recover the watermark, we employ a forensic network F ψ , which takes the potentially manipulated image T ( X ) as input and simultaneously produces the extracted watermark ˆ W and a tampering localization map ˆ M :

Here, ˆ W is expected to be reliably recovered with its integrity preserved, while ˆ M precisely identifies the manipulated regions, ensuring a robust and effective framework for both watermark extraction and tampering detection.

B Comparison of Existing Methods

In this section, we provide a concise overview of the key comparison methods, summarized in Tab. 5. As illustrated, this work focuses on two primary tasks: tampering localization and copyright protection for content generated by diffusion models. The compared copyright protection approaches encompass both traditional post-hoc image watermarking techniques and more recent diffusion-native watermarking methods that integrate directly with the generative process. Tampering detection methods are categorized into passive localization and proactive protection strategies. Our proposed approach offers a unified, diffusion-native solution for both tampering detection and copyright protection, achieving state-of-the-art performance across both tasks.

C In-depth Analysis of Mixture-of-Experts Guided Forensic Network

In this paper, we introduce a Mixture-of-Experts Guided Forensic Network (MoE-GFN), which trains specialized expert modules to address distinct forensic sub-tasks, thereby enhancing the overall forensic performance. At the core of MoE-GFN is the Mixture-of-Forensic-Experts (MoFE) block,

Appendix

comprising three domain-specific experts and a dynamic soft router. As illustrated in Fig. 5, we visualize the feature activations of each expert alongside the weight distributions produced by the dynamic router. The watermark extraction expert exhibits strong activation in untampered regions rich in watermark signals ( x wm), effectively recovering the embedded global watermark and demonstrating robustness to local tampering. The tampering localization expert focuses on corrupted regions ( x tamp), identifying missing watermark areas and enabling precise localization of tampering. The boundary enhancement expert targets the edges of tampered regions ( x bound), extracting fine-grained features to refine boundary detection. Unlike static fusion strategies, the dynamic router assigns adaptive weights to each expert's features based on input characteristics ( R wm , R tamp , R bound), facilitating a more effective integration of forensic cues and significantly improving both watermark extraction and tampering localization accuracy ( x unified). In the Ablation Study section in the main text, we also analyzed in detail the role of each expert and dynamic fusion strategy of MoFE and the final impact on the quantization results.

(a) Original

(b)

x

wm

(c)

x

tamp

(d)

x

bound

(e)

x

unified

(g)

R

wm

(h)

R

tamp

(i)

R

bound

(j) GT

D Training Process of StableGuard

We present the detailed training procedure of StableGuard in Algorithm 1. The entire process is fully self-supervised and trained in an end-to-end manner, without requiring any manually annotated data. Both the embedding of diffusion-native watermarks and the training of the joint model for watermark and tampering forensics are accomplished within a unified framework.

Algorithm 1 Training Process of StableGuard.

Input: Input image X , iteration steps steps , LDM VAE encoder E µ , LDM VAE decoder D ν . Output: MPW-VAE decoder D φ , MoE-GFN F ψ .

1: for i = 1 to steps do

2: Inverse latent z = E µ ( X ) .

3: Decode watermark-free image ˆ X = D ν ( z ) .

4: Decode watermarked image Y = D φ ( z ) .

5: Generate random tamper mask M .

6: Generate tamper image ˆ Y by Eq. (3).

7: Predict watermark and tamper area ˆ W, ˆ M = F ψ ( ˆ Y )

8: Comptue loss by Eq. (13).

9: Update D φ and F ψ .

10: end for

E More Implementation Details and Experiments

E.1 More Implementation Details

In our experiments, we utilized two datasets: one consisting of real images from COCO [56], and the other comprising generated images from a Text-to-Image dataset. For the real image dataset, we first reconstructed each image using our MPW-VAE and then embedded a holistic watermark into the reconstructed image. For the generated dataset, we began by obtaining the denoised latent representation through stable diffusion, which was then decoded into the image space using the MPW-VAE decoder to produce the watermarked image.

Text-to-Image (T2I) Dataset . The T2I dataset is designed to evaluate the watermarking effectiveness of StableGuard in the LDM framework. To construct this dataset, we first generate the latent embedding of each image using the original pre-trained Stable Diffusion [1] denoising UNet, condition on its corresponding textual prompt. We then decode this embedding through our MPW-VAE, producing a set of watermarked images. Specifically, we leverage ChatGPT 2 to generate 1,000 textual prompts, with each prompt yielding 10 images, resulting in a dataset of 10,000 images.

AIGCTampering Dataset . 3 The AIGC tampering dataset is collected to benchmark the performance of various tampering localization techniques against manipulations introduced by state-of-the-art image editing methods [1, 2, 4, 57, 58]. This large-scale dataset consists of 35,000 images, comprising 25,000 from COCO and 10,000 from our T2I dataset. We utilize the Segment Anything Model (SAM) [49] to generate semantic masks by segmenting images, after which we apply Stable Diffusion Inpainting [1], Stable Diffusion XL [2], Kandinsky Inpainting [57], ControlNet [4], and LAMA [58] to edit the segmented regions. During the tampering process, we applied modifications to selected regions and composited the altered content onto the watermarked image using a corresponding binary mask following by [21, 22].

Metrics. We leverage several widely-used metrics to collaboratively evaluate the pixel-level fidelity and perceptual quality of the generated images, including Peak Signal-to-Noise Ratio (PSNR), Structural Similarity Index Measure (SSIM) [60], Learned Perceptual Image Patch Similarity (LPIPS) [54], and Fréchet Inception Distance (FID) [61]. To quantify the performance of watermark extraction, we adopt the Bit Accuracy metric to calculate the proportion of correctly extracted watermark bits over the total embedded bits. For tampering detection, we used the F1 Score, the Area Under Curve (AUC), and IoU metrics to assess the accuracy and completeness of the detected area. The F1 Score is the harmonic mean of detection precision and recall, and AUC represents the area under the ROC Curve. IoU is calculated by the intersection over the union between the detected tampered areas and the ground-truth regions.

Forensic Decoder. The forensic decoder consists of two parallel decoding heads: 1) The mask prediction head is responsible for localizing tampered regions and is implemented as a lightweight two-layer convolutional network. 2) The watermark prediction head is used for recovering the embedded watermark and comprises a two-layer convolutional network followed by a fully connected layer. This modular design allows the network to jointly optimize for both localization and watermark reconstruction.

E.2 Tampering Localization Results on Traditional Tampering Dataset

Our proposed StableGuard framework can be naturally extended to conventional natural images through reconstruction using a variational autoencoder, demonstrating strong generalization across a wide range of image domains. To assess its effectiveness beyond synthetic settings, we conducted comprehensive evaluations on five widely used tampering datasets: CASIA [62], NIST [63], Columbia [64], and Coverage [65]. The corresponding quantitative results and visual comparisons are reported in Tab. 6 and Fig. 6.

Although existing passive tampering localization methods are trained on meticulously constructed paired datasets, they consistently fall short when compared to our StableGuard and its predecessor EditGuard, OmniGuard and WAM. This performance gap reveals the inherent limitations of passive, post-hoc approaches, which often lack robustness when faced with novel manipulations or diverse

(a)

(b)

(c)

(d)

(e)

(f)

(g)

(h)

(i)

(j)

(k)

(l)

(m)

Figure 6: The visualization comparison of tampering localization results on the traditional tampering dataset. (a) is the tampered image, (b)-(m) are the tampering localization results of MVSS-Net [15], PSCC-Net [17], ObjectFormer [18], TruFor [66], NCL-IML [67], IML-ViT [16], HDF-Net [19], EditGuard [21], OmniGuard [22], WAM [23], our StableGuard, and the ground truth, respectively.

image distributions. In contrast, our findings underscore the advantages of proactive forensic methods, particularly those grounded in watermarking strategies that are embedded during the generative process. These methods exhibit greater resilience and accuracy in both tampering detection and localization.

In addition, StableGuard demonstrates superior performance over other methods across a variety of practical scenarios. It achieves this improvement while eliminating the need for complex and often restrictive post-processing procedures. This enhancement is largely attributed to the Mixture of Experts Guided Forensic Network, which is designed to extract and integrate diverse forensic cues. By employing specialized expert modules and adaptive feature routing, the network enables StableGuard to jointly perform watermark recovery and tampering localization in a coherent and dependable manner.

E.3 Time Complexity Analysis

We conducted additional experiments to evaluate the inference latency and memory footprint of our framework. The detailed results are summarized in Tab. 7. Specifically, we measured the runtime and memory usage of our MPW-VAE in comparison to the baseline Stable Diffusion VAE (at a resolution of 512 × 512 ), as well as the runtime of the MoE-GFN forensic network under identical settings. The results show that MPW-VAE introduces only negligible computational overhead relative to the original diffusion V AE. Moreover, the MoE-GFN model achieves competitive runtime efficiency, with both inference latency and memory consumption well within the bounds required for practical deployment.

E.4 Forensic Accuracy under Varying Tampering Ratios

We further analyze watermark extraction accuracy under different levels of tampering, ranging from 10% to 90%. The results in Tab. 8 demonstrate that our method consistently outperforms existing approaches across all tampering ratios. This robustness stems from three main factors: 1) The MPWVAE effectively encodes holistic watermark features at multiple scales during decoding, enhancing the resilience of watermark embedding. 2) The global self-attention mechanism in our watermark extraction expert captures long-range dependencies and contextual cues that remain intact even when large regions are tampered. 3) The use of randomly generated masks with varying coverage during training, including large-area tampering, encourages the model to generalize across diverse manipulation ratios and ensures reliable watermark extraction even under severe distortions.

E.5 True Positive Rate (TPR) under Tampering Scenarios

Our framework is designed as a proactive watermarking system [21-23], where the watermark plays a central role in simultaneously enabling copyright protection and tampering localization. Unlike passive detection methods, we assume that images are watermarked at creation time; thus, clean images without watermarks fall outside our system's operational scope and can be conservatively regarded as 'fully tampered.' To assess practical reliability, we measure false positives in two scenarios: (1) untampered regions within partially tampered watermarked images, and (2) fully untampered, watermarked images. As shown in Tab. 9, our method achieves the lowest false positive rate (measured as the ratio of false positive pixels to the total number of untampered pixels) in both cases, demonstrating its robustness and reliability.

E.6 Performance across Different Tampering Types

We also conducted a per-type analysis of tampering detection accuracy, as reported in Tab. 10. Our approach consistently delivers strong performance across diverse manipulation types, underscoring its robustness and generalizability.

E.7 Robustness under Real-World Image Degradations

To evaluate real-world applicability, we conducted additional experiments with diverse image degradation operations, including: (1) aggressive compression, (2) severe resolution downsampling, and (3) color transformations. The parameter ranges for each transformation are summarized in Tab. 11. As shown in the results, our framework maintains high watermark extraction accuracy and reasonable tampering localization performance. This observation aligns with our design intuition: watermark extraction leverages global cues that are relatively robust to distortions, whereas tampering localization relies on local consistency, making it more sensitive to compression and resampling artifacts. Importantly, the decline in localization accuracy remains moderate and within acceptable limits, highlighting the resilience of our method in real-world scenarios.

E.8 More Visual Results

Fig. 7 and Fig. 8 present additional visual results of tampering localization on the AIGC tampering dataset of COCO [56] and T2I Dataset, respectively. Please zoom in for the best view.

F Disscussion and Limitations

StableGuard is specifically designed for image latent diffusion models. However, since watermarking is applied solely through the variational autoencoder decoder within the latent diffusion framework, our approach can be naturally extended to video latent diffusion models. Given the rapid progress in this area, adapting our method to the video domain represents an important direction for future research.

While our approach maintains strong performance under certain levels of image degradation, it is not entirely immune to the decline in forensic accuracy caused by such distortions. Addressing the sensitivity of forensic performance to image degradation remains a current limitation of our method and a key focus for future investigation.

(a)

(b)

(c)

(d)

(e)

(f)

(g)

(h)

(i)

(j)

(k)

(l)

(m)

(a)

(b)

(c)

(d)

(e)

(f)

(g)

(h)

(i)

(j)

(k)

(l)

(m)

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents StableGuard, a unified framework for copyright protection and tampering localization based on a global watermark embedded during the diffusion process. The MPW-VAE module ensures that the embedded watermark maintains high visual fidelity in the watermarked images. In addition, the MoE-GFN module integrates three experts: Watermark Extraction, Tampering Localization, and Boundary Detection. These modules work together to improve the accuracy of forensic analysis.\n\nSTRENGTHS AND WEAKNESSES:\n### Strengths\n\n1. The paper is clearly written, with detailed explanations of the proposed method and its components.\n\n2. The work introduces a diffusion-based watermark for tampering localization by embedding watermarks during the image generation process. This provides a valuable supplement to the field.\n\n### Weaknesses\n\n1. The proposed method uses a single watermark to achieve both copyright protection and tampering localization, which involves a trade-off between robustness and localization sensitivity. Although the authors employ two expert modules for extracting different features, it seems that the final decision relies on $x_{unified}$​. When the tampered region becomes large, this may reduce watermark extraction accuracy. It would be helpful if the authors could report the performance of watermark extraction under different tampering ratios.\n\n2. The robustness of the method appears to be limited or requires further evaluation. Methods like WAM[1] also support both tampering localization and watermark extraction with a single watermark, and are able to resist a wide range of transformations. A comparison or discussion would strengthen the contribution.\n\nQUESTIONS:\n1. In Equation (3), why is the fusion based on a random choice between $X$and$\\hat{X}$? It seems that using either one consistently might be sufficient.\n\n2. The paper provides detailed descriptions of each module. However, the architecture of the forensic decoder is not clearly explained. Could the authors briefly describe its structure?\n\n[1]Sander, Tom, et al. \"Watermark Anything with Localized Messages.\" Proceedings of the International Conference on Learning Representations. 2025.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 5, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-06-25"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis work proposes a method for both copyright protection and image manipulation localization using Stable Diffusion models. Specifically, it introduces two novel components: (1) MPW-VAE, which generates both watermarked and watermark-free images for self-supervised learning, and (2) MoE-GFN, which is designed for watermark verification and manipulation localization.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n1) The paper is well-written, with clear and detailed descriptions of the proposed method.\n2) The proposed approach achieves improved performance over state-of-the-art methods.\n3) The experiments and ablation studies are thorough and well-designed.\n\nWeaknesses:\n1) The use of self-supervised learning has been explored in prior works [1][2], but these related methods are not discussed in the related work section.\n2) Table 2 does not specify the manipulation types or the number of samples per type for the evaluated datasets.\n3) The performance across different manipulation types should be reported to better understand the method's effectiveness in various scenarios.\n\n\n\n[1] Zhai, Yuanhao, Tianyu Luan, David Doermann, and Junsong Yuan. \"Towards generic image manipulation detection with weakly-supervised self-consistency learning.\" In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 22390-22400. 2023.\n\n[2] Zhang, Zhenfei, Mingyang Li, Xin Li, Ming-Ching Chang, and Jun-Wei Hsieh. \"Image Manipulation Detection with Implicit Neural Representation and Limited Supervision.\" In European Conference on Computer Vision, pp. 255-273. Cham: Springer Nature Switzerland, 2024.\n\nQUESTIONS:\n1) The paper mentions that random splicing is applied after MPW-VAE. Could the authors clarify why only splicing is considered? What would be the effect of applying other manipulation types, such as random copy-move or random removal, in this step?\n2) What is the approximate inference time of the proposed model for processing a single image, including both watermark verification and manipulation localization?\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper introduces StableGuard, a unified diffusion-native framework designed to both embed imperceptible binary watermarks during latent diffusion model (LDM) generation and later verify ownership and localise tampered regions in potentially manipulated images.The core component, Multiplexing-Watermark VAE (MPW-VAE), leverages lightweight residual “watermark adapters” inserted after each decoder block. By toggling adapters on or off, the same latent code yields visually identical watermarked and clean pairs, enabling fully self-supervised training. A Mixture-of-Experts Guided Forensic Network (MoE-GFN) combines three specialised branches—watermark extraction, tamper localisation, and boundary refinement—via a dynamic soft routing mechanism. The entire system is trained end-to-end with a combined similarity, watermark, and tamper loss, so watermark embedding and forensic signal learning reinforce each other. Comprehensive experiments on COCO, a 10k text-to-image dataset, and five tampering benchmarks demonstrate higher watermark bit-accuracy, improved fidelity, and substantially stronger localisation compared to post-hoc watermarking baselines and state-of-the-art passive detectors (MVSS-Net, HDF-Net). Ablation studies confirm the contributions of each module.\n\nSTRENGTHS AND WEAKNESSES:\nThis paper demonstrates several notable strengths.\n1.The paper presents a well-designed approach with clear algorithmic formulation, sensible loss functions, and comprehensive ablation studies. The authors thoroughly evaluate the impact of MPW-VAE variants, expert configurations, and routing strategies, which strengthens the credibility of the results.\n\n2.Experiments cover multiple degradation scenarios (noise, JPEG compression, Poisson noise), demonstrating that the method remains effective under moderate distortions.\n\n3.The work addresses an important and timely problem: provenance verification and tamper localisation for AI-generated images. The results show that end-to-end joint training of watermark embedding and localisation can achieve substantial gains over existing post-hoc methods.\n\nHowever, there are also important weaknesses to consider. \n1.All localisation benchmarks are synthetic and based on LDM-generated edits; there is no evaluation on human-made forgeries or realistic manipulations such as colour grading, rescaling, or recompression commonly seen in the wild.\n\n2.Computational costs are reported only in FLOPs, without details on actual runtime latency or memory footprint during inference, making it difficult to assess feasibility for deployment.\n\n3.The experiments do not address resilience to aggressive real-world compression, and the false-positive rate on clean, non-watermarked images remains unexplored, which raises concerns about practical reliability.\n\nQUESTIONS:\n1.How does StableGuard perform under severe downsampling (e.g., 1024→256 px) or aggressive social-media recompression (JPEG Q=30, WebP, HEIC)? Including such experiments would significantly strengthen the practical relevance of your results.\n\n2.For real-world deployment, what are the actual latency and VRAM requirements when generating 1024×1024 images with MPW-VAE, compared to vanilla Stable Diffusion? A table with runtime per image on a modern GPU (e.g., RTX 4090) would be highly informative.\n\n3.Your training masks are random binary regions, whereas real tampering often aligns with semantic boundaries. Have you experimented with using SAM-based masks or object-aware masks to narrow this domain gap?\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 5, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe work proposes a novel framework StableGuard to address the need for robust copyright protection and tampering detection in images generated by LDMs. The framework consists of two components: Multiplex Watermark VAE (MPW-VAE) and Mixture-of-Experts Guided Forensic Network (MoE-GFN) which are optimized jointly in a self-supervised fashion. MPW-VAE integrates watermark via residual-based adapters which are inserted after each VAE decoder block. MoE-GFN consists of three blocks: Watermark extraction, Tampering localization and Boundary enhancement and for all three of these, a dynamic soft router is employed to adapt task relevant features. StableGuard is trained on COCO training set and evaluated on COCO test set and custom T2I dataset. It is evaluated for both watermark extraction and tampering localization tasks.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n+ The paper is well-written and easy to understand.\n+ The idea of joint optimization of watermark integration and tampering localization is novel and interesting.\n+ Evaluations show state-of-the-art results in forensic accuracy and robustness.\n\nQUESTIONS:\n- For evaluation of watermark extraction, only quantitative comparison has been shown in Table 1. Figure 3 only shows the qualitative results of the proposed solution, it would be good to see the qualitative comparison with the existing methods also to access the visual quality of the watermarked images for all methods.\n- For quantitative comparisons, one of the recent work is missing:\na. Zhang, X., Tang, Z., Xu, Z., Li, R., Xu, Y., Chen, B., Gao, F. and Zhang, J., 2025. Omniguard: Hybrid manipulation localization via augmented versatile deep image watermarking. In Proceedings of the Computer Vision and Pattern Recognition Conference (pp. 3008-3018).\n- For WEE, TLE, BEE more discussion is required for each component contribution, in ablation study 3rd, 4th and 5th rows marks very minor difference for F1, AUC, IoU and Bit accuracy with respect to each other. It raises the question of why three different extraction methods were required in the first place?\n- Details of custom T2I dataset used for evaluation of watermark extraction are limited, as this is custom it would be beneficial to see the stats of the prompts used for this dataset generation like diversity of this dataset, which categories were used for selection, how were these selected?\n- Eq.(8) mentions LPIPS as Similarity loss, I think the correct version of mentioning LPIPS here is perceptual loss as we are defining the loss function and LPIPS is mostly used as an evaluation term.\n\nLIMITATIONS:\nNA", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 5, "CLARITY": 4, "IMPACT": 4, "ORIGINALITY": 4, "DATE": "2025-07-15"}