Title: Shallow Diffuse: Robust and Invisible Watermarking through Low-Dim Subspaces in Diffusion Models
Venue: NeurIPS 2025
Accepted: yes
Keywords: diffusion Model

watermark

low-dimensional subspace

consistency

robustness
Abstract: The widespread use of AI-generated content from diffusion models has raised significant concerns regarding misinformation and copyright infringement. Watermarking is a crucial technique for identifying these AI-generated images and preventing their misuse. In this paper, we introduce *Shallow Diffuse*, a new watermarking technique that embeds robust and invisible watermarks into diffusion model outputs. Unlike existing approaches that integrate watermarking throughout the entire diffusion sampling process, *Shallow Diffuse* decouples these steps by leveraging the presence of a low-dimensional subspace in the image generation process. This method ensures that a substantial portion of the watermark lies in the null space of this subspace, effectively separating it from the image generation process. Our theoretical and empirical analyses show that this decoupling strategy greatly enhances the consistency of data generation and the detectability of the watermark. Extensive experiments further validate that *Shallow Diffuse* outperforms existing watermarking methods in terms of consistency.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis work proposes a diffusion model watermarking technique that embeds signals into a low-dimensional subspace’s null space, aiming to decouple watermark information from image content. The method claims to maintain image fidelity while ensuring robustness against attacks, supported by experiments comparing favorably against existing approaches in quality preservation and robustness.\n\nSTRENGTHS AND WEAKNESSES:\n### Strengths  \n1. The focus on authenticating generative model outputs addresses a timely security challenge in real-world deployments.  \n2. Leveraging low-rank PMP Jacobian properties to minimize watermark interference without model retraining demonstrates analytical insight.  \n3. The paper is logically structured and technically accessible, with clear motivation and methodology.  \n\n### Weaknesses\n1. **Robustness Validation:** While multiple attack scenarios are tested, inclusion of **rotation robustness evaluation** would strengthen claims given its prevalence in image manipulations.  \n2. **Contextual Positioning:** Comparison with Robin [1] —which similarly embeds watermarks at shallow diffusion steps and aims for semantic preservation—would better situate the claimed advantages in semantic preservation.  \n\n[1] ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimization. NeurIPS 2024.\n\nQUESTIONS:\n1. The two primary distinctions from Tree-Ring – (a) later-stage embedding and (b) high-frequency localization – appear impactful. Could the authors provide ablation studies clarifying how each contributes to robustness/image quality?\n\n2. Conventional wisdom suggests low-frequency watermarks resist signal processing (compression/filtering) but suffer poor geometric robustness, while high-frequency variants show the inverse tradeoff. Yet Appendix Table 8 reports **identical robustness (1.00)** for low/high-frequency variants (rotational rand circle) under tested distortions. *Would stronger attacks (e.g., aggressive compression or rotation) reveal expected tradeoffs?*\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-06-29"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nTo address the challenge of embedding invisible and robust watermarks in images generated by diffusion models, the paper proposes Shallow Diffuse, a simple and effective watermarking method. It utilizes the insight that diffusion models exhibit low sensitivity to perturbations in specific low-dimensional subspaces of their latent representations. By perturbing only a few diffusion steps along these subspaces, watermarks can be embedded in a way that is imperceptible, robust to post-processing, and compatible with existing models without retraining. Experiments across multiple diffusion architectures show strong robustness and negligible perceptual degradation, even under common corruptions and transformations.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\n-\tTraining-free method is efficient and practical in real world scenario.\n-\tFigure 1 shows the significant advantage of Shallow Diffuse in terms of consistency compared to previous methods.\n\n\nWeaknesses:\n\n-\tLack of analysis on inversion robustness. Shallow Diffuse relies on DDIM inversion for watermark detection, which can be fragile under certain distortions like random drop. The paper does not analyze how inversion quality impacts detection robustness compared to methods like Stable Signature that the watermark is embed in the decoder. Moreover, the robustness of inversion to these attacks has to be discussed.\n-\tRestricted watermark capacity. The method supports only sequential binary watermarks. It remains unclear whether more complex payloads (e.g., graphic watermarks) can be embedded and extracted.\n\nQUESTIONS:\n-\tUnclear trade-off between perturbation and visual consistency. As a training-free method, Shallow Diffuse perturbs latent variables while aiming to preserve image appearance. Without learning, it is unclear how the method balances invisibility and robustness under strong distortions.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-06-29"}

comments: SUMMARY:
This paper presents Shallow Diffuse, a watermarking framework for diffusion‑based image generation that operates in a low‑dimensional subspace. Unlike existing approaches that embed watermarks throughout the entire sampling trajectory, Shallow Diffuse injects the watermark at a single, intermediate diffusion step and confines it to a low‑rank subspace. This decoupling from the main generation process helps preserve image fidelity while ensuring the watermark remains detectable and consistent across various post‑processing attacks. The authors derive theoretical guarantees for both watermark consistency and detectability under a low‑rank Jacobian assumption. Empirically, Shallow Diffuse is benchmarked against Gaussian Shading, RingID, and other methods on multiple datasets, demonstrating superior robustness and image quality in both server‑side and user‑side watermarking scenarios.

STRENGTHS AND WEAKNESSES:
## Strengths

**1. Solid Theoretical Analysis:** Provides formal bounds on watermark consistency and detectability.

**2. Comprehensive Experiments:** Demonstrates good performance on both server‑side and user‑side.

**3. Clear and Coherent Presentation:**  Algorithm pseudocode, theoretical proofs, and experimental results are well‑organized.

## Weaknesses

**1. Missing Geometric Attack Evaluation:** Omits crucial geometric distortions (rotation, cropping, scaling), which are common in practical  settings.

QUESTIONS:
See Weaknesses.

LIMITATIONS:
See Weaknesses.
TITLE: Official Review
CLARITY: 3
IMPACT: 2
ORIGINALITY: 2
DATE: 2025-07-03

comments: SUMMARY:
In this manuscript, the authors introduce a robust and invisible watermarking method for diffusion models. It operates in both server-side and user-side scenarios by injecting the watermark into a low-dimensional subspace during generation or via DDIM inversion. The method leverages the null space of the Jacobian in diffusion model sampling to decouple watermarking from image generation. Extensive theoretical analysis and empirical results demonstrate the effectiveness of the proposed method.

STRENGTHS AND WEAKNESSES:
The core idea of exploiting low-rank Jacobians and null space projection is elegant and well-motivated by the observed local linearity in the denoising process of diffusion models. Shallow Diffuse works well in both server and user scenarios.

Although built on Stable Diffusion 2.1, it remains unclear how generalizable the approach is to other architectures or modalities (e.g., audio, video diffusion). 

While consistency metrics are strong, subjective quality comparisons (e.g., human perceptual study or user ratings) are not discussed. Especially in the user scenario, it would be useful to validate perceptual invisibility.

In line 203, the authors mentioned "In practice, we choose t 142 ∗ = 0.3T based on results from the ablation study". Please provide more explanations and is this setting generalizable to other usecases, such as audio, video diffusion

QUESTIONS:
See the Weaknesses

LIMITATIONS:
yes
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-07-07