Title: T2SMark: Balancing Robustness and Diversity in Noise-as-Watermark for Diffusion Models
Venue: NeurIPS 2025
Accepted: yes
Keywords: Watermark

Diffusion Models
Abstract: Diffusion models have advanced rapidly in recent years, producing high-fidelity images while raising concerns about intellectual property protection and the misuse of generative AI. Image watermarking for diffusion models, particularly Noise-as-Watermark (NaW) methods, encode watermark as specific standard Gaussian noise vector for image generation, embedding the infomation seamlessly while maintaining image quality. For detection, the generation process is inverted to recover the initial noise vector containing the watermark before extraction. However, existing NaW methods struggle to balance watermark robustness with generation diversity. Some methods achieve strong robustness by heavily constraining initial noise sampling, which degrades user experience, while others preserve diversity but prove too fragile for real-world deployment. 
To address this issue, we propose T2SMark, a two-stage watermarking scheme based on Tail-Truncated Sampling (TTS). 
Unlike prior methods that simply map bits to positive or negative values, TTS enhances robustness by embedding bits exclusively in the reliable tail regions while randomly sampling the central zone to preserve the latent distribution. Our two-stage framework then ensures sampling diversity by integrating a randomly generated session key into both encryption pipelines. 
We evaluate T2SMark on diffusion models with both U-Net and DiT backbones. Extensive experiments show that it achieves an optimal balance between robustness and diversity.

T2SMark: Balancing Robustness and Diversity in Noise-as-Watermark for Diffusion Models

Abstract

Diffusion models have advanced rapidly in recent years, producing high-fidelity images while raising concerns about intellectual property protection and the misuse of generative AI. Image watermarking for diffusion models, particularly Noiseas-Watermark (NaW) methods, encode watermark as specific standard Gaussian noise vector for image generation, embedding the infomation seamlessly while maintaining image quality. For detection, the generation process is inverted to recover the initial noise vector containing the watermark before extraction. However, existing NaW methods struggle to balance watermark robustness with generation diversity. Some methods achieve strong robustness by heavily constraining initial noise sampling, which degrades user experience, while others preserve diversity but prove too fragile for real-world deployment. To address this issue, we propose T2SMark, a two-stage watermarking scheme based on Tail-Truncated Sampling (TTS). Unlike prior methods that simply map bits to positive or negative values, TTS enhances robustness by embedding bits exclusively in the reliable tail regions while randomly sampling the central zone to preserve the latent distribution. Our two-stage framework then ensures sampling diversity by integrating a randomly generated session key into both encryption pipelines. We evaluate T2SMark on diffusion models with both U-Net and DiT backbones. Extensive experiments show that it achieves an optimal balance between robustness and diversity.

1 Introduction

In recent years, diffusion models [1-4] have achieved groundbreaking advances in generative AI, especially in image synthesis. Owing to their iterative denoising process, these models can produce highly realistic images. As their architecture scales and training datasets expand, diffusion models continually improve in both generation quality and controllability, driving rapid progress in AIGC technologies.

However, this swift evolution also brings new challenges: the authenticity of generated content is increasingly difficult to verify, and diffusion models have become potent instruments for spreading disinformation and manipulating public opinion. For example, during the 2024 U.S. presidential election, U.S. officials accused Russia and other countries of using generative AI to fabricate fake news,









































images, and videos to influence voter sentiment and disrupt the electoral process 2 . Meanwhile, service providers invest vast amounts of data and computing power to train these models and urgently need effective mechanisms to safeguard their intellectual property against unauthorized use. Together, these concerns have increased the demand for robust solutions to protect the copyright and trace the provenance of AI-generated images, making this a focal point of current academic research.

To address these challenges, watermarking presents a fundamental solution and has shown considerable promise. Among various techniques, Noise-as-Watermark (NaW) methods, including Gaussian Shading (GS) [5] and PRC-Watermark (PRCW) [6], stand out. At its core, NaW maps watermark codewords onto a standard Gaussian noise vector, uses it as the initial noise for image generation, and thus embeds watermark information while preserving the noise distribution. For extraction, one simply inverts the diffusion process to recover the embedded noise and subsequently decodes it to retrieve the watermark. The reversible bijection offered by the forward and backward diffusion processes between high-entropy Gaussian vectors and the low-entropy image manifold allows NaW methods to achieve high-capacity, lossless embedding for individual images without the need for supplementary training.

The embedding process in most Noise-as-Watermark (NaW) methods comprises two core steps: discrete encoding and continuous sampling. The former step converts the watermark message into codewords, while the latter transforms those discrete binary codes into continuous noise. The challenge in discrete encoding lies in balancing the need for randomness, which makes the watermark difficult to predict, with the need for robustness against various distortions - goals that are often contradictory. Continuous sampling, on the other hand, is critical for maintaining imperceptibility by precisely preserving the initial Gaussian noise distribution. Current methods make different trade-offs: GS [5] employs a simple repetition code for high robustness but lacks randomness, depending entirely on the sampling process for variation. PRCW [6], while using a pseudorandom error-correcting code [7] for better undetectability, exhibits weak robustness and can fail when subjected to common inversion errors.

To overcome these limitations and achieve a balance of both robustness and diversity, we propose T2SMark , a novel two-stage watermarking scheme built upon TailTruncated Sampling (TTS) . While previous efforts have concentrated primarily on discrete encoding strategies, we observed that Gaussian samples closer to the origin are significantly more vulnerable to sign errors when noise is present. This finding inspired our TTS approach: instead of a simple positive/negative mapping for bits, TTS divides the Gaussian distribution into three distinct areas: one for

Prior Methods

Ours

bit-0, one for bit-1, and an undecided region (see Figure 2). Information is embedded only within the more reliable tail regions, with the central region being sampled randomly to compensate for diversity and maintain the overall distribution. Additionally, our two-stage framework introduces controlled randomness via hierarchical key encryption. A static master key encrypts a randomly generated session key in the first stage, and this session key is then used to encrypt the actual watermark bits in the second stage. This layered encryption randomizes both parts of the watermark codewords, thereby further ensuring the generation diversity. Finally, we improve detection and decoding by employing multidimensional projections of the reconstructed Gaussian noise, allowing us to fully leverage its rich continuous information.

Evaluated on diffusion models [3, 8] with both U-Net [9] and DiT [4] backbones, T2SMark demonstrates an optimal trade-off between watermark robustness and generative diversity.

2 Related Work

2.1 Diffusion Models

Diffusion models [1-4] iteratively corrupt data by injecting Gaussian noise and train a denoising network to reverse this process. The canonical DDPM framework [1] employs a stochastic Markov chain for multi-step sampling, delivering outstanding sample quality at the cost of slow inference.

Building on DDPM, DDIM [2] reformulates the random process as a deterministic ODE, transforming sampling into an invertible mapping that both accelerates generation and enables inversion-making it the backbone of many inversion-based watermarking techniques [5, 6, 10]. Moreover, latent diffusion models (LDMs) [3] first compress high-dimensional data into a lower-dimensional latent space and then perform noise addition and denoising in that compact space. This strategy dramatically reduces computation while preserving generation quality and significantly boosting efficiency.

Inspired by the Transformer's success in NLP [11-13], researchers have introduced self-attention into diffusion models. Diffusion transformers (DiTs) [4] leverage the scalability of transformer architectures for image generation. Today, many leading diffusion pipelines [8, 14, 15] adopt DiT backbones, driving advances in high-fidelity and efficient synthesis.

Generation diversity is an essential metric for assessing a model's creative capacity. ODE-based samplers [2, 16, 17] achieve faster inference by discarding stochastic noise during denoising, which means that diversity depends entirely on the initial noise vector. As a result, any watermarking scheme that alters or constrains the initial noise sampling can have a direct effect on generation diversity.

2.2 Image Watermarking for Diffusion Models

Image watermarking methods for diffusion models can be divided into three main categories. 1) Postprocessing schemes [18-21] embed a watermark directly into the generated image-using either traditional transform-domain techniques [18] or deep learning-based methods [19-21]-without modifying the sampling process. While this preserves model diversity, it inevitably degrades visual quality and provides only limited robustness. 2) Fine-tuning schemes [22, 23] inject watermarks by adapting either the diffusion model's denoiser or, in a latent diffusion setup, the V AE [24] backbone; these methods maintain sample fidelity but require costly weight updates as model architectures grow. 3) Inversion-based schemes [5, 6, 10] embed information into the initial Gaussian noise sample and recover it by inverting the diffusion process. This category includes perturbation-based approaches such as Tree-Ring [10] and RingID [25], which adds robust Fourier-domain patterns at the expense of distributional bias, and Noise-as-Watermark (NaW) techniques such as Gaussian Shading (GS) [5] and PRC-Watermark (PRCW) [6], which use distribution-preserving sampling to achieve high embedding capacity without shifting the noise distribution. Our T2SMark method also falls into this NaW paradigm. Building upon the principles of Tree-Ring, other methods such as ROBIN [26] and ZoDiac [27] focus on ownership detection rather than message embedding. These are 0-bit watermarking schemes, designed solely to verify if an image was generated by a specific model. They leverage gradient-based optimization to embed an imperceptible signature, achieving impressive fidelity and competitive robustness. However, their design philosophy differs significantly from our approach. By not needing to be strictly identical to an unwatermarked original, training-free NaW methods can fully leverage the initial noise space to achieve a high capacity (e.g., 256-bit) for traceability. Given these fundamental differences in goals (detection vs. traceability) and methodology (optimization-based vs. training-free), we do not conduct a direct comparison with them in this paper.

3 Method

3.1 Threat Model

Scenarios. This study considers four key parties: the provider, who operates a closed API image generation service maintaining proprietary model weights and training data; the compliant user, who adheres to platform policies and utilizes the outputs legitimately; the unauthorized user, who illicitly obtains images to claim them as their own; and the malicious user, who exploits the API to generate and disseminate harmful or deceptive content.

Detection. The provider embeds a single-bit watermark into every image generated and serves through the API. Both compliant and malicious users receive only watermarked outputs, whereas unauthorized users have no means to obtain unmarked images. Even after typical manipulations, such as compression or cropping, our extraction algorithm robustly recovers the embedded watermark bit, thereby furnishing incontrovertible proof of the provider's legitimate copyright while simultaneously signaling the image's synthetic origin.

Traceability. Each API account is uniquely assigned an identity watermark. In instances of misuse, extracting the embedded identity watermark from a suspect image (potentially after data augmentation designed to evade tracing) enables the provider to match it against the account database, thus pinpointing the source, deterring unauthorized distribution, and holding malicious actors accountable.

3.2 Overview

Decoding

Combine

Encoding

Decoding

011100...

10101100...

Generation

Watermark Extraction

011100...

Watermarked Vector

Key

Key

Message

Message

10101100...

Attack

Watermark

1

0

1

0

Watermark

Sampling

Projection

Encoding

Encoding

Sign

?

Detection

Master Key

Inversion

Detection

Decoding

(

) for 1st stage

(

) for 2nd stage

Verification

Independent

RNG

PRNG

PRNG

PRNG

PRNG

(

) for 1st stage

(

) for 2nd stage

T2SMark can be clearly illustrated by Fig. 3. We first split the noise vector into two segments: the first encodes a random session key under a fixed master key, and the second uses that session key to encode the actual watermark bits. Because both segments depend on the random key, the full vector remains randomized.

Formally, in the single-stage setting, we treat the n -dimensional noise space as a direct sum of orthogonal subspaces. The key pseudorandomly selects a hyperplane through the origin that splits each subspace into two half spaces for binary encoding. During sampling, we employ Tail-Truncated Sampling : points are drawn along each hyperplane's normal and kept at least a distance τ from the boundary. This thresholding carves out a robust watermark-encoding subspace of larger-magnitude vectors that resist cross-boundary perturbations, while the remaining dimensions carrying no bits retain randomness.

At extraction, we reconstruct the noise via an inversion algorithm [2] and project it onto the same set of hyperplane normals. Each bit is recovered from the sign of its projection, which identifies the half-space containing the sample, while detection uses the projection's L 1 norm as a confidence measure. This approach fully exploits the continuous structure of the noise vector. The detailed scheme follows in subsequent sections.

3.3 Watermark Encoding

Here, encoding means mapping the watermark into a continuous noise vector, not just discrete coding. Let n ∈ N be the initial noise dimension, τ ≥ 0 the truncation threshold for Tail-Truncated Sampling, m ∈ N the watermark length, and b ∈ {± 1 } m the bit-vector.

Based on the threshold τ , we determine the expected number of tail-sampled dimensions k and the per-bit subspace dimension r :

Using a secret key K as the seed for a PRNG (Pseudorandom Number Generator), we generate a set of m pseudorandom vectors { v j } j m =1 , where each v j ∈ {-1 , 0 , +1 } n . These vectors are designed with orthogonal, non-overlapping supports and serve as the normal vectors for the bit-encoding hyperplanes within the watermark embedding subspace:

̸

Next, we form the binary mask w = ∑ m j =1 | v j | ∈ { 0 , 1 } n . This mask partitions the n dimensions into the watermark-encoding subspace ( w i = 1 ) and the random-noise subspace ( w i = 0 ). Tail-Truncated Sampling (TTS) is applied to sample components for the noise vector z :

where T N ( µ, σ 2 ; I ) denotes the normalized truncation of N ( µ, σ 2 ) over interval I . The final watermarked noise vector z w is then constructed by combining the signs corresponding to the bits in the tail-sampled dimensions with their magnitudes from z , while incorporating the random samples from the central dimensions. This is achieved by:

where ⊙ is the Hadamard product. The term ∑ m j =1 b j v j represents the directional encoding of the bits b within the subspace defined by { v j } j m =1 .

3.4 Watermark Decoding

Upon reconstructing the watermarked noise ̂ z w via diffusion inversion [2], we regenerate the set of vectors { v j } j m =1 using the same secret key K . The projection vector p ∈ R m is computed by taking the dot product of ̂ z w with each vector v j :

The watermark bit-vector ̂ b is recovered directly from the signs of the projection vector components:

where sign( · ) is applied elementwise to the m -dimensional vector p . With a per-bit encoding dimension r less than ⌊ n/m ⌋ (indicating reduced repetition), a higher signal-to-noise ratio (SNR) is achieved by TTS, theoretically leading to an even lower probability of bit error under the AWGN assumption (see Appendix A).

3.5 Two-Stage Watermark

We split the n -dimensional noise into two segments of dimensions n k and n b (with n k + n b = n ), often corresponding to channelwise partitioning. First, using the master key K , we sample an n k -dimensional vector z k that encodes a random session key K r . Next, with K r , we sample an n b -dimensional vector z b containing the watermark bits b . The combined watermarked noise is given by z w = z k ∥ z b , where ( ·∥· ) denotes vector concatenation.

During extraction, we partition the reconstructed noise ̂ z w into ̂ z k and ̂ z b . We first recover K ′ r from ̂ z k via the master key K , and then retrieve the watermark ̂ b from ̂ z b using K ′ r . The session key K r thus serves a dual role: embedded payload in the first segment and key for the second, injecting randomness across z w and preserving generation diversity.

3.6 Detection and Traceability

Detection relies primarily on the first stage due to the risk of error propagation in two-stage decoding. Leveraging the larger norms of projections afforded by TTS, the test statistic is computed based on the L 1 norm of the first-stage projection vector:

In this equation, m k denotes the size of the session key. p k is the projection vector obtained by projecting ̂ z k onto the first stage's normal vectors { v kj } m k j =1 . This statistic l is compared against a threshold d calibrated to a target false-positive rate.

For traceability, full two-stage decoding is performed to recover the complete embedded bit-vector ̂ b . This decoded watermark is compared against the registered identity watermark database. The account whose assigned watermark yields the highest similarity score (e.g., match count or Hamming distance) is identified as the image's originator, enabling misuse tracing and accountability.

4 Experiments

4.1 Experimental Setup

Implementation Details. Our image generation backbone is Stable Diffusion v2.1 (SD v2.1) [3], configured with a guidance scale of 7.5, 50 DDIM denoising steps, and a fixed 512 × 512 output resolution. T2SMark employs a 16-bit session key and a 256-bit watermark. We set the truncation threshold to τ = 0 . 674 . The session key is embedded in the first channel of the initial noise. This is determined empirically in our parameter selection study (see Appendix B.2). All the experiments are implemented in PyTorch 2.4.1 and run on a single NVIDIA RTX A6000 GPU.

Baselines. We compare against three categories of existing methods. Traditional post-processing transforms include dwtDct [18], dwtDctSvd [18], and the learning-based RivaGAN [19]; fine-tuning approaches are represented by Stable Signature [22]; Inversion-based Schemes include Tree-Ring (TRW) [10], Gaussian Shading (GS) [5] and PRC-Watermark (PRCW) [6]. For all inversion-based methods, we perform 10-step DDIM inversion [2]. During inversion, we employ an empty prompt and fix the guidance scale at 1 to simulate unknown prompt conditions. To ensure fair capacity, dwtDct, dwtDctSvd, Gaussian Shading, and PRC-Watermark all embed 256 bits. RivaGAN and Stable Signature use 32 bits and 48 bits respectively, following their official implementations.

Evaluation. We evaluate on MS-COCO-2017 [28] dataset (COCO) and Stable-Diffusion-Prompt 3 dataset (SDP). For robustness, we compare the TPR at a fixed FPR = 10 -6 in the detection setting and per-bit accuracy in the traceability setting. For each method, we sample 500 prompts from the SDP training split, generate 500 watermarked images, apply nine different distortions (see Figure 4), and then perform detection and traceability.

We assess generation diversity via LPIPS [29]. For each non-post-processing method, we generate 10 images for each of 1,000 COCO test prompts with a fixed master key and watermark, compute LPIPS over the 45 unique pairs per prompt, and report the overall mean. Post-processing methods leave the core generation unchanged and are therefore omitted from this evaluation.

̸

For visual quality, we report the CLIP score [30] and FID [31]. We run 10 independent trials: in each trial, we fix a single key-watermark pair (simulating one user), and generate 1 000 images from COCO's test prompts for the CLIP score and FID. We then perform two-sample t -tests to assess the impact of the watermark on quality. The hypotheses are H 0 : µ s = µ 0 , H 1 : µ s = µ 0 , where µ s and µ 0 denote the mean FID or CLIP score computed over multiple sets of watermarked and clean images, respectively. A lower t -value indicates stronger support for H 0 . Details about the t -test can be found in Appendix B.3.

4.2 Main Results

Results for the different methods are presented in Table 1. T2SMark demonstrates superior performance in the traceability scenario while achieving detection performance comparable to the best

(a)

(b)

(c)

(d)

(e)

(f)

(g)

(h)

(i)

(j)

method, GS [5]. In contrast, PRCW [6] performs worst in traceability and registers a detection TPR below 30% under adversarial conditions, which is too fragile for real-world deployment. More detailed robustness results under various noise types can be found in Appendix B.4.

With respect to generation diversity, measured by LPIPS [29], PRCW achieves the highest score. T2SMark trails closely behind, with a difference of less than 10 -3 , representing a negligible gap. GS exhibits the lowest diversity score, which is attributable to its use of a fixed codeword for each user, while Stable Signature and TRW also experience noticeable reductions in diversity.

Regarding image quality, only T2SMark and PRCW consistently satisfy the no-degradation criterion across both evaluation tests. Although GS achieves a competitive CLIP score [30], its FID [31] deviates significantly from the no-watermark baseline. Furthermore, GS exhibits a noticeably larger standard deviation in the CLIP score and FID, suggesting that its generation quality is sensitive to the specific watermark and key used. This sensitivity poses a challenge for the user experience, potentially leading to inconsistent generation quality when different user accounts (with different watermarks/keys) are involved. Considering all the evaluated metrics, T2SMark achieves the best overall balance.

4.3 Undetectability

To evaluate watermark undetectability, we trained a ResNet-18 classifier [32] to distinguish between watermarked and non-watermarked images. We assessed four inversion-based methods using a fixed key and watermark for each. The training set for each method consisted of 8,000 watermarked and 8,000 clean samples, while the test set contained 500 samples each. Training was conducted for 10 epochs with a batch size of 128 and a learning rate of 1 × 10 -4 . Table 2 reports the test accuracy. The results indicate that TRW [10] and GS [5] are relatively easy to detect. Although

PRCW [6] demonstrates the highest level of undetectability, we observe that it is not entirely immune to detection. T2SMark achieves the second-best performance and can also be considered difficult to detect, demonstrating a high level of imperceptibility.

4.4 Generalizability

Weevaluate T2SMark along with other inversion-based watermarking methods on the Stable Diffusion v3.5 Medium model (SD v3.5M) [8], which employs DiT [4] as its denoising network and features a 16-channel latent space. The detailed settings can be found in Appendix B.1.

The results in Table 3 show that SD v3.5M delivers superior generative quality so that all methods maintain strong visual fidelity. TRW's robustness declines markedly compared with its performance on SD v2.1, and GS experiences a similar loss of diversity. PRCW improves traceability but still trails the best method by a wide margin. In contrast, T2SMark achieves the best balance of robustness and diversity, and its undetectability is virtually indistinguishable from that of PRCW.

4.5 Ablation Study

In this section we conduct ablation experiments on SD v2.1 to evaluate robustness under varying hyperparameter settings. Unless otherwise specified, we generate 500 images on the SDP dataset and report the true positive rate at a fixed false positive rate of 10 -6 alongside bit accuracy.

Tail-Truncated Sampling. We evaluate T2SMark both with and without Tail-Truncated Sampling (TTS), and additionally measure generation diversity over 1,000 prompts from the SDP dataset. The results in Table 4 demonstrate that TTS provides a substantial robustness boost while having only a negligible effect on diversity. This confirms TTS as a critical component of T2SMark.

Noise Intensities. To further test the robustness, we conduct experiments using different intensities of noise. The results are shown in Figure 5(a-i). T2SMark is highly vulnerable to Gaussian noise-even at a low noise standard deviation of 0.1, its performance degrades dramatically, a weakness that has also been reported in experiments of other inversion-based methods [5, 10].

































































































































































































































































































































Guidance Scales. Given diverse user preferences for prompt adherence, higher guidance scales enforce the original prompt more strictly, while lower scales allow greater creative freedom. Since Stable Diffusion v2.1 typically uses guidance scales between 5 and 15, our experiments span a wider range of 2-18. As shown in Figure 5(j), T2SMark's performance degrades only marginally under these settings.

Inversion Steps. We evaluate T2SMark with 5, 10, 25, 50, and 100 inversion steps (Table 5) and observe only minor performance fluctuations. Therefore, we can directly improves the extraction efficiency by reducing the number of inversion steps, as inversion is the primary bottleneck in NaW extraction pipelines.

Watermark Capacity. We evaluate T2SMark using watermark capacity of 256, 384, 512, 768 and 1024 bits (Table 6). As expected, the robustness of T2SMark degrades with increased capacity. However, if the actual noise level in deployment is lower than that used in our experiments, a moderate increase in capacity remains tolerable.

Session Key Size. We evaluate T2SMark via random key sizes of 8, 16, 24, and 32 bits (Table 7). As the length of the random key increases, it becomes more difficult to extract the key perfectly in the first stage, which leads to cascading errors and a rapid drop in bit accuracy. While longer keys can theoretically enhance randomness, we find that a 16-bit key provides sufficient entropy for practical use-since it is unlikely that a single user would generate a number of images large enough to exhaust this space. Moreover, even with a 32-bit random key, T2SMark still maintains acceptable robustness.

5 Limitations

Despite its wonderful performance on diversity and robustness, T2SMark is subject to several limitations. A key set of challenges is shared among most NaW methods. First, the high robustness that allows for watermark recovery can be exploited in a forgery attack. An adversary could use a proxy model to invert the diffusion process, recover the watermarked noise vector, and then use this vector to generate new, forged images that appear authentic because they carry a valid watermark [33]. Second, T2SMark, like other NaW schemes, depends on an invertible, ODE-based sampling method (e.g., DDIM [2], DPM-Solver [16]). Without such a sampler, the initial noise cannot be reconstructed, preventing watermark recovery and limiting applicability to diffusion models that support this feature. Third, NaW methods are vulnerable to geometric distortions since their designs lack explicit mechanisms to resist it. Recent work like GaussMarker [34] offers effective solutions to this. Finally, there is a potential conflict with certain controllable generation methods that require modifying the core sampling logic, as this could interfere with the watermark embedding and detection process. In addition to these shared challenges, T2SMark has a unique vulnerability stemming from its key embedding strategy: Embedding the session key in the truncated tails concentrates energy in a way that introduces subtle distributional anomalies, which can be detected.

6 Conclusion

T2SMark presents a novel watermarking framework for diffusion-generated images. It leverages Tail-Truncated Sampling (TTS) to increase robustness and employs a two-stage key hierarchy to introduce controlled randomness and support generation diversity. Experiments on both the U-Net [9] and DiT [4] architectures demonstrate that T2SMark achieves superior traceability and competitive detection performance while effectively preserving diversity and image quality.

Acknowledgments

This work was supported in part by the National Natural Science Foundation of China under Grant 62472398, Grant U2336206, Grant U2436601, and Grant 62402469.

References

Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In Advances in Neural Information Processing Systems , pages 6840-6851. Curran Associates, Inc., 2020.

Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In International Conference on Learning Representations , 2021.

Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. Highresolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages 10684-10695, June 2022.

William Peebles and Saining Xie. Scalable diffusion models with transformers. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) , pages 4195-4205, October 2023.

Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shading: Provable performance-lossless image watermarking for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages 12162-12171, June 2024.

Sam Gunn, Xuandong Zhao, and Dawn Song. An undetectable watermark for generative image models. arXiv preprint arXiv:2410.07369 , 2024.

Miranda Christ and Sam Gunn. Pseudorandom error-correcting codes. In Advances in Cryptology - CRYPTO 2024 , pages 325-347, 2024.

Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, et al. Scaling rectified flow transformers for high-resolution image synthesis. In Forty-first international conference on machine learning , 2024.

Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomedical image segmentation. In Medical image computing and computer-assisted intervention-MICCAI 2015: 18th international conference, Munich, Germany, October 5-9, 2015, proceedings, part III 18 , pages 234-241. Springer, 2015.

Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust. arXiv preprint arXiv:2305.20030 , 2023.

Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural information processing systems , 30, 2017.

Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies, volume 1 (long and short papers) , pages 4171-4186, 2019.

Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in neural information processing systems , 33:1877-1901, 2020.

Yixin Liu, Kai Zhang, Yuan Li, Zhiling Yan, Chujie Gao, Ruoxi Chen, Zhengqing Yuan, Yue Huang, Hanchi Sun, Jianfeng Gao, et al. Sora: A review on background, technology, limitations, and opportunities of large vision models. arXiv preprint arXiv:2402.17177 , 2024.

Junsong Chen, Jincheng Yu, Chongjian Ge, Lewei Yao, Enze Xie, Yue Wu, Zhongdao Wang, James Kwok, Ping Luo, Huchuan Lu, et al. Pixart-\ alpha : Fast training of diffusion transformer for photorealistic text-to-image synthesis. arXiv preprint arXiv:2310.00426 , 2023.

Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan LI, and Jun Zhu. Dpm-solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps. In Advances in Neural Information Processing Systems , volume 35, pages 5775-5787, 2022.

Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpmsolver++: Fast solver for guided sampling of diffusion probabilistic models. arXiv preprint arXiv:2211.01095 , 2022.

Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker. Digital watermarking and steganography . Morgan kaufmann, 2007.

Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. arXiv preprint arXiv:1909.01285 , 2019.

Zhaoyang Jia, Han Fang, and Weiming Zhang. Mbrs: Enhancing robustness of dnn-based watermarking by mini-batch of real and simulated jpeg compression. In Proceedings of the 29th ACM International Conference on Multimedia , page 41-49, 2021.

Rui Ma, Mengxi Guo, Yi Hou, Fan Yang, Yuan Li, Huizhu Jia, and Xiaodong Xie. Towards blind watermarking: Combining invertible and non-invertible mechanisms. In MM'22 , page 1532-1542, 2022.

Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) , pages 22466-22477, October 2023.

Rui Min, Sen Li, Hongyang Chen, and Minhao Cheng. A watermark-conditioned diffusion model for ip protection. In European Conference on Computer Vision , pages 104-120. Springer, 2024.

Diederik P Kingma, Max Welling, et al. Auto-encoding variational bayes. arXiv preprint arXiv:1312.6114 , 2013.

Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification. In Proceedings of the European Conference on Computer Vision (ECCV) , page 338-354, 2024.

Huayang Huang, Yu Wu, and Qian Wang. Robin: Robust and invisible watermarks for diffusion models with adversarial optimization. Advances in Neural Information Processing Systems , 37: 3937-3963, 2024.

Lijun Zhang, Xiao Liu, Antoni V Martin, Cindy X Bearfield, Yuriy Brun, and Hui Guan. Attack-resilient image watermarking using stable diffusion. Advances in Neural Information Processing Systems , 37:38480-38507, 2024.

Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer vision-ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, proceedings, part v 13 , pages 740-755. Springer, 2014.

Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 586-595, 2018.

Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning , pages 8748-8763. PmLR, 2021.

Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems , 30, 2017.

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , June 2016.

Andreas Müller, Denis Lukovnikov, Jonas Thietke, Asja Fischer, and Erwin Quiring. Black-box forgery attacks on semantic watermarks for diffusion models. arXiv preprint arXiv:2412.03283 , 2024.

Kecen Li, Zhicong Huang, Xinwen Hou, and Cheng Hong. Gaussmarker: Robust dual-domain watermark for diffusion models. arXiv preprint arXiv:2506.11444 , 2025.

Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A largescale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition , pages 248-255. Ieee, 2009.

Xingchao Liu, Chengyue Gong, and Qiang Liu. Flow straight and fast: Learning to generate and transfer data with rectified flow. arXiv preprint arXiv:2209.03003 , 2022.

A BEP Analysis under Tail-Truncated Sampling

We model decoding as a binary decision under additive white Gaussian noise (AWGN) with variance σ 2 . Owing to the symmetry of the problem, we analyze the case corresponding to the transmission of bit 1 without loss of generality. Let µ ( τ ) and D ( τ ) represent the mean and variance of a standard normal variable truncated in [ τ, + ∞ ) . Aggregating r truncated samples yields a test statistic with an effective signal-to-noise ratio

In practice we approximate S ( τ ) by

and the corresponding bit-error probability is

where Φ( · ) is the standard normal CDF. For a tail-truncated Gaussian distribution,

where ϕ ( · ) is the standard normal PDF.

To assess whether the truncation's SNR gain outweighs the redundancy loss for small τ > 0 , define

Then A ( τ ) = aB ( τ ) C ( τ ) and

First, at τ = 0 ,

since D (0) ≥ 0 and σ 2 > 0 . Next,

Since C ′ ( τ ) = -1 2 ( D ( τ ) + σ 2 ) -3 / 2 D ′ ( τ ) , and from (14) and (17) we have

Combining (13), (14), (15), and (18) in the product rule for A ′ ( τ ) gives

This analysis, following the provided equations, demonstrates that under the AWGN model, initiating truncation (i.e. using a small threshold τ > 0 ) strictly decreases the bit-error probability. Although this model is an idealization, it predicts the existence of an optimal threshold τ , whose value is typically determined empirically, as discussed in Section B.2.

B Experimental Details and Additional Experiments

B.1 Implementation Details

Experiments on SD v2.1. In these experiments, we use Stable Diffusion v2.1 [3] to generate 512 × 512 images with a guidance scale of 7.5 and 50 DDIM denoising steps [2], into which we embed watermarks. For dwtDct, dwtDctSvd [18], and RivaGAN [19], we employ the implementation from the GitHub repository 4 . Stable Signature [22], TRW [10], GS [5], and PRCW [6] are run via their official GitHub codes. We fine-tune Stable Signature for 100 steps with a batch size of 4 on 400 images from the ImageNet2014 validation set [35]. Since TRW is a single-bit scheme, we evaluate it only in the detection setting, using its robust Ring mode in channel 3 as recommended. GS is used with its default paper settings, and PRCW is configured for 256 bit capacity. RivaGAN and Stable Signature retain their original capacities of 32 and 48 bits, respectively-higher capacities generally worsen extraction performance and image quality. However, none of these methods surpass T2SMark even under these generous capacity settings.

Experiments on SD v3.5M. To assess the generalizability of our proposed T2SMark, we evaluate it alongside other inversion-based watermarking methods on the Stable Diffusion 3.5 Medium model (SD v3.5M) [8]. SD v3.5 adopts a Rectified Flow training objective [36], operates in a larger 16channel latent space, and leverages the more scalable DiT transformer architecture. Because it also employs ODE-based sampling, inversion-based watermarking methods can be adapted to it directly. For robustness, we generate watermarked images for 500 prompts from the SDP training set with a guidance scale of 7.5; for image quality, we sample the COCO test set [28] with a guidance scale of 4.0 to emphasize diversity. All methods use 40 inference steps and 10 inversion steps. Embedding occurs in the 16-channel latent space: for TRW and T2SMark's first stage we use the first four channels; GS uses f ch = 4 , f h = 8 , and f w = 8 (256-bit capacity); and PRCW and T2SMark both embed a 256-bit watermark. T2SMark further employs a 16-bit random key, as in our SD v2.1 setup.

B.2 Parameter Selection

Threshold τ . We select τ by generating 256-bit, single-stage watermarks on 100 non-overlapping SDP prompts, applying distortions, and measuring bit accuracy. As shown in Table 8, bit accuracy first increases rapidly with τ and then slowly decreases. To balance robustness without over-constraining sampling, we choose τ = -Φ -1 ( 4 16 ) ≈ 0 . 674 .

Embedding Channel of the Session Key. Different latent channels exhibit varying inversion errors and detectability. We measure the post-distortion inversion MSE and detection rate for channels 0-3 on the same dataset. As Table 9 shows, Channel 1 achieves the lowest MSE but is easily detected, while Channel 3 has the lowest detection rate but higher error. We therefore select Channel 0 to balance undetectability and reconstruction fidelity.

B.3 Details about the t -test

For evaluating the CLIP score [30] and FID [31], we generated n s = n 0 = 10 image sets for a two-sample t -test. We test the hypotheses

̸

where µ s and µ 0 denote the mean metric values for watermarked and clean images, respectively. The t -statistic is computed as

where S s and S 0 are the sample standard deviations. A lower t -value supports H 0 , while t > t 0 . 05 , n s + n 0 -2 = t 0 . 05 , 18 ≈ 2 . 101 leads us to reject H 0 and conclude that watermarking significantly affects model performance. Otherwise, we consider the watermark to be distortion-free.

B.4 Detailed Results of Robustness Evaluation

We report robustness evaluation results on SD v2.1 against various noise types in Table 10, with corresponding results on SD v3.5M in Table 11. T2SMark consistently outperforms all competing methods across nearly every distortion. Its single notable weakness is Gaussian noise, which likely arises because the inversion process is especially sensitive to this perturbation-an effect also observed in other inversion-based schemes [5, 10]. Cascading errors of the two-stage framework exacerbate this vulnerability, causing T2SMark to incur a greater performance decline under Gaussian noise.

B.5 Results on Different Datasets

To avoid dataset-induced bias, we evaluate watermarking methods on two distinct datasets. Robustness is measured on the COCO dataset [28], while image quality and generation diversity are assessed on the SDP dataset. Since SDP provides no ground-truth references, the FID cannot be computed; therefore, we report only the CLIP score and LPIPS diversity. The results are summarized in Table 12.

B.6 Details about Evaluation of Undetectability

To assess undetectability, we fine-tuned a pretrained ResNet-18 [32] classifier. For each inversionbased watermarking method and an unwatermarked Stable Diffusion baseline, we generated 8,500 images from the SDP training set-8,000 for training and 500 for testing. The semantic content was controlled with a fixed prompt set so that the classifier could not exploit content differences. All the watermark methods use a fixed key and watermark across images. Figures 6 and 7 respectively show the training loss and test accuracy over epochs on SD v2.1 and SD v3.5M. TRW [10] and GS [5] are easily detected, while PRCW [6] and T2SMark achieve only marginal detection accuracies just above 50%. Notably, PRCW is not completely immune to detection, with a test accuracy that is consistently greater than 50%. T2SMark performs better on SD v3.5M, indicating that the diffusion model itself critically impacts undetectability. Purely cryptographic undetectability may over-constrain the encoding and sacrifice robustness.

2

4

6

8

10

Epoch

0.0

0.1

0.2

0.3

0.4

Train Loss

Tree-Ring

Train Loss

Test Acc

2

4

6

8

10

Epoch

0.000

0.025

0.050

0.075

0.100

0.125

0.150

Train Loss

Train Loss

Test Acc

2

4

6

8

10

Epoch

0.0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

Train Loss

PRC-Watermark

Train Loss

Test Acc

2

4

6

8

10

Epoch

0.0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

Train Loss

T2SMark

Train Loss

Test Acc

50

60

70

80

90

100

Test Acc (%)

50

60

70

80

90

100

Test Acc (%)

50

60

70

80

90

100

Test Acc (%)

50

60

70

80

90

100

Test Acc (%)

2

4

6

8

10

Epoch

0.0

0.1

0.2

0.3

0.4

Train Loss

Tree-Ring

Train Loss

Test Acc

2

4

6

8

10

Epoch

0.00

0.05

0.10

0.15

0.20

0.25

Train Loss

Train Loss

Test Acc

2

4

6

8

10

Epoch

0.0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

Train Loss

PRC-Watermark

Train Loss

Test Acc

2

4

6

8

10

Epoch

0.0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

Train Loss

T2SMark

Train Loss

Test Acc

50

60

70

80

90

100

Test Acc (%)

50

60

70

80

90

100

Test Acc (%)

50

60

70

80

90

100

Test Acc (%)

50

60

70

80

90

100

Test Acc (%)

B.7 Detailed Results of Ablation Studies

Tables 13, 14 and 15 present detailed ablation results for the inversion steps, watermark capacity and session key size. Within practical ranges, our method supports flexible adjustment of the embedding capacity-including the session key size-without altering any other parameters, making it well

suited for real-world deployment. Because diffusion models allow users to select image resolutions freely, our scheme naturally accommodates different resolutions without additional tuning, whereas methods such as GS [5] require modifying the diffusion factor, which can be cumbersome.

Under adversarial distortions, we observe a slight decline in bit accuracy as the number of inversion steps increases. We attribute this to complex interactions between certain perturbations, such as brightness changes, and the inversion process.

B.8 Analysis of Computational Overhead

We conducted a timing comparison for all watermark methods. Experiments were run on a system equipped with an AMD EPYC 7662 Processor and an NVIDIA RTX A6000 GPU. All inversion-based methods utilized FP16 precision and performed 10 inversion steps on an SD v2.1 model [3].

B.9 Impact of the Two-Stage Framework

To assess the impact of the two-stage framework, we evaluate T2SMark both with and without it. All experiments use Stable Diffusion v2.1 [3] under the same settings as the main paper. For robustness testing, we sample 500 prompts from the Stable-Diffusion-Prompts training split; for generation diversity, we use 1,000 prompts from the same dataset and report LPIPS scores [29]. Results are shown in Table 17.

Enabling the two-stage framework reduces adversarial bit accuracy from 0.9868 to 0.9754, since reserving latent dimensions to encrypt the session key cuts redundancy and causes cascading errors-any mistake in decoding the session key invalidates the second-stage decoding. However, it substantially increases generation diversity, confirming its importance for balancing robustness and diversity. In contrast, without two-stage encryption, T2SMark suffers from the same fixed-codeword limitation as Gaussian Shading [5] and overconcentrates energy in the high-energy tail region, whose position in the latent vector is entirely key-dependent , significantly reducing diversity.

C Visual Results

Generation Diversity. Figure 8, 9, 10, and 11 visually compare the generation diversity achieved by various watermarking methods on SD v2.1 and SD v3.5M. Images produced with Gaussian Shading [5], for example, display a highly consistent layout, indicating limited diversity.

SD v2.1

TRW

GS

PRCW

T2SMark

SD v2.1

TRW

GS

PRCW

T2SMark

SD v2.1

TRW

GS

PRCW

T2SMark

SD v3.5M

TRW

GS

PRCW

T2SMark

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: Section 1 presents the main contributions of this paper, which are concisely summarized in both the abstract and the introduction.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: The potential attack vectors and usage limitations of our method are discussed in Section 5.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the p elf ormance of the approach. For example, a facial recognition algorithm may p elf orm poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory assumptions and proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [Yes]

Justification: This paper includes theoretical result, and the assumption and proof are provided in Appendix A.

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental result reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: We include complete experimental details in Section 4.1 and Appendix B.1 to enable reproduction of our results .

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [Yes]

Justification: Our code is provided in the supplementary material, with detailed usage instructions available in the accompanying README.

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental setting/details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: We provide detailed settings in Section 4.1 and Appendix B.1.

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment statistical significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [Yes]

Justification: We report the means and standard errors for experimental results in Tables 1, 3, and 12.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments compute resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: The GPU used to conduct our experiments is specified in Section 4.1.

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code of ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: The research conducted in the paper conforms with the NeurIPS Code of Ethics.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [NA]

Justification: The answer NA means that there is no societal impact of the work performed.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: The answer NA means that the paper poses no such risks.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [NA]

Justification: The answer NA means that the paper does not use existing assets

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [NA]

Justification: The answer NA means that the paper does not release new assets.

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and research with human subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional review board (IRB) approvals or equivalent for research with human subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

16. Declaration of LLM usage

Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.

Answer: [NA]

Justification: The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.

Guidelines:

The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.

Please refer to our LLM policy ( https://neurips.cc/Conferences/2025/LLM ) for what should or should not be described.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes T2SMark, a novel two-stage watermarking framework for diffusion models that balances robustness and generation diversity. The method embeds watermark bits exclusively in reliable tail regions of Gaussian noise while randomly sampling the central zone to achieve robustness and diversity. A two-stage key hierarchy (master key + session key) injecting controlled randomness to further preserve diversity. Extensive experiments demonstrate superior watermark traceability, diversity, and minimal visual quality degradation.\n\nSTRENGTHS AND WEAKNESSES:\n### Strengths：\n1.The conflict between robustness and diversity in watermarking diffusion outputs is well-articulated and timely, given the increasing deployment of diffusion models. \n\n2.The two-stage key hierarchy decouples randomness control from watermark encoding, ensuring diversity without sacrificing security.\n\n3.The paper is well-structured and technically accessible.  \n\n\n### Weaknesses：\n1. The watermarking pipeline by modifying the initial noise in diffusion models is relatively common. However, such modification can be substantial and may potentially affect the model's applicability in controllable generation methods that rely on initial noise characteristics, such as Golden noise [1] and InitNO [2].\n\n[1] Golden Noise for Diffusion Models: A Learning Framework. 2411.09502 arXiv. \n\n[2] InitNO: Boosting Text-to-Image Diffusion Models via Initial Noise Optimization. 2024 CVPR. \n\n2. While the paper emphasizes improvements in diversity and provides quantitative results (e.g., LPIPS), the visual evidence is limited. Only one example visualization (Fig. 8 in the Appendix) under a single prompt is provided. Comparisons with more baseline methods through visual results are notably lacking.\n\n3. The paper lacks a comparison of the time overhead, specifically in terms of watermark embedding and verification times, with other existing schemes.\n\n4. The decision to embed the session key in channel 0 (based on inversion error and detectability) appears empirically driven, but the rationale may not generalize across models or sampling resolutions.\n\n5. While multiple attack scenarios are tested, inclusion of rotation would strengthen claims given its prevalence in image manipulations.\n\nQUESTIONS:\n1. Fundamentally, this work is an extension of the tree-ring watermarking approach, which also modifies the initial noise. Similar methods (tree-ring, Gaussian shading, and PRC) inherently produce images that differ from the original, unwatermarked generations, leading to potentially uncontrolled diversity variations. Newer methods, such as ROBIN [1] and ZoDiac [2], enable watermark embedding during the generation process itself, achieving outputs that are visually indistinguishable from their watermark-free counterparts. The paper, however, appears to overlook direct comparisons with these relevant recent techniques.\n\n[1] ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimization. 2024 NeurIPS.\n\n[2] Attack-Resilient Image Watermarking Using Stable Diffusion. 2024 NeurIPS.\n\n2. Undetectability evaluation assumes fixed watermark and key: This is an unrealistic assumption in real-world settings, where keys vary per user. The classifier’s performance might change substantially in such settings, especially since randomness is a core contribution of T2SMark. Further evaluation with randomized watermark instances would strengthen the claim of imperceptibility.\n\n3. Error propagation can be observed in two-stage decoding under strong noise (Tab.11 GauNoise). Robustness could be improved via error-correcting codes?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-29"}

comments: SUMMARY:
The paper addresses the challenge of balancing robustness and generation diversity in noise-as-watermark (NaW) methods for diffusion models. Existing NaW approaches often encode watermarks in sensitive regions of the Gaussian noise space, which compromises either the watermark robustness or the diversity of generated images. To address this, the authors propose T2SMark, a two-stage encoding framework that introduces (1) Tail-Truncated Sampling (TTS) restricts watermark embedding to the more stable tails of the Gaussian distribution, and (2) a Two-Stage secure encoding scheme using random session keys.

STRENGTHS AND WEAKNESSES:
Strengths:

-	Compatible with existing diffusion models. Similar to other NaW approaches, T2SMark does not require any architectural modifications or fine-tuning, making it practical and plug-and-play.
-	Tail-Truncated Sampling (TTS) is insightful and effective for the balance of robustness and diversity.

Weaknesses:

-	The undecided zone may affect the length of the injectable watermark and limit the watermarking capacity.
-	Evaluation lacks direct fidelity metrics. Using FID between two unpaired sets is indirect. Pairwise metrics like PSNR between clean and watermarked images would more accurately quantify distortion. 
-	Figure 1 lacks quantitative support. The current illustration is too abstract. Including numerical comparisons would make the visual argument more credible.

QUESTIONS:
-	LPIPS may not be ideal for measuring diversity. While LPIPS reflects perceptual difference, it may not fully capture diversity. Other metrics like Inception Score and CLIP Score may offer complementary insights.

LIMITATIONS:
yes
TITLE: Official Review
CLARITY: 2
IMPACT: 2
ORIGINALITY: 2
DATE: 2025-06-29

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes T2SMark , a watermarking framework for diffusion models that balances robustness against distortions and enhances generation diversity. It introduces a two-stage approach with a tailored inversion process to embed watermarks and a tail-truncated sampling (TTS) strategy to enhance robustness.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n\n1. T2SMark introduces TTS, which partitions the Gaussian noise distribution into three regions bit-0, bit-1, and an undecided central zone. By embedding information exclusively in the reliable tail regions and randomly sampling the central area, the method reduces sign errors caused by noise perturbations while preserving the latent distribution.\n\n2. The two-stage framework with hierarchical encryption structure to randomize bit messages, ensuring diversity in generated outputs without compromising security. \n\nWeakness\n\n1. Similar to Gaussian Shading (GS). T2SMark proposes a similar watermarking paradigm to the GS method. They all use a master key to generate a session key and then encrypt it into the noise vector. The watermark decoding all relies on the DDIM. There is a lack of comparison with the GS baseline to highlight the contribution of the T2SMark from the methodology perspective. \n\n2. Limited theoretical insights. The paper focuses on empirical validation with minimal theoretical analysis of the TTS mechanism or robustness guarantees. The TTS sampling also relies on the pre-defined threshold $\\tau$, which can be case-by-case sensitive.\n\n3. Vulnerability to Gaussian noise: The inversion process remains sensitive to this distortion, a known issue in prior inversion-based methods. The authors acknowledge but do not resolve this.\n\nQUESTIONS:\n1. Following the weakness 1. Besides the TTS sampling, is there any other contributions make T2SMark significantly outperform the GS baseline? \n2. Following the weakness 2. Can the authors provide a theoretical analysis of TTS sampling and why it makes watermarking more robust and diverse? How is the threshold $\\tau$ calculated, or is it determined empirically?\n3. Following the weakness 3. Despite the TTS mechanism, why does T2SMark remain vulnerable to Gaussian noise? Could this be mitigated via robust optimization during inversion?\n4. The diversity is measured by the LPIPS metrics. While LPIPS is commonly used for image perceptual quality. I have a concern about this metric for its effectiveness in representing diversity. Can the authors provide more evidence to support the appropriate usage of LPIPS for diversity? To further estimate the diversity, I believe authors should show more visualizations and even user study to support their claim.\n5. The GS baseline can keep the watermarked results similar to the original non-watermarked generated results, and it is also able to show diversity to some extent. Can the T2SMark method also preserve the similarity between the watermarked results and non-watermarked model results? So that users can flexibly watermark their generated results.\n6. Can the proposed method be extended to the Diffusion Transformer method?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nProblem: \nA challenge for existing NaW methods, such as Gaussian Shading (GS) and PRC-Watermark (PRCW), lies in obtaining an optimal balance between watermark robustness and generation diversity. Some methods (ex: GS) heavily constrain initial noise sampling and therefore prioritize strong robustness which limits the variability of generated images. Other methods (ex: PRCW) that preserve diversity are sometimes fragile for real-world deployment as they fail under common distortions.\n\nMethod\n- To address the above issue, the paper introduces T2SMark, a novel two-stage watermarking scheme which is based on Tail-Truncated Sampling (TTS). \n- T2SMark's design has two primary innovations:\n   1. TTS enhances robustness by embedding bits exclusively within the reliable tail regions of the Gaussian distribution, while randomly sampling the central zone to maintain the latent distribution. This approach is different from previous methods that just map bits to positive or negative values - using the statistical properties of the noise for improved resilience.\n   2. The two-stage framework ensures sampling diversity by integrating a randomly generated session key into both encryption pipelines - Static master key encrypts this random session key in the first stage, which then encrypts the actual watermark bits in the second stage. This encryption introduces controlled randomness across the full noise vector and preserves generation diversity.   \n\nEvaluation\n- The method is evaluated on diffusion models with both U-Net and DiT backbones which demonstrates its ability to achieve an optimal balance between robustness and diversity. \n- The method shows better traceability and competitive detection performance, while effectively preserving image quality and generalizability across different diffusion model architectures.\n\nSTRENGTHS AND WEAKNESSES:\nSTRENGTHS:\n1. Principled method:\n    - TTS is introduced to enhance robustness by embedding bits in the more reliable tail regions of the Gaussian distribution - this is supported by theoretical BEP analysis in Appendix A which shows that truncation decreases bit error probability. \n    - The two stage key hierarchy ensures generation diversity and robustness by using a random session key, encrypted by a master key, to then encrypt the watermark bits, injecting randomness across the noise vector. For decoding, multidimensional projections of the reconstructed Gaussian noise are used to recover watermark bits robustly.\n2. Comprehensive experiments\n    - Comparison against multiple baselines - traditional post processing, fine tuning, and SOTA inversion based techniques.\n    - Multiple metrics (TPR, Bit Acc, LPIPS, CLIP score, FID) are used for evaluation, and undetectability is assessed via a ResNet classifier. \n    - Robustness is evaluated on 9 distortion types\n    - Evaluation on both SD 2.1 (UNet) and SD 3.5 M (DiT) demonstrates the method's generalizability across different diffusion model architectures.\n3. The results clearly show T2SMark's balance across robustness, diversity, and quality, many times outperforming or matching baselines. \n4. Sufficient implementation details are provided for reproducibility - specific SD versions, guidance scales, denoising steps, PyTorch version, GPU used and relevant Github codes.\n\nWEAKNESSES\n1. T2SMark is highly vulnerable to Gaussian noise, even at low intensities which is a practical concern for real-world deployment and a common limitation for inversion-based methods.\n2. The ablation study shows rapid bit accuracy drop for longer session keys due to cascading errors, raising scalability questions for high-entropy keys.\n3. Empirical tuning of parameters like truncation threshold τ suggests potential sensitivity to new model architectures, requiring re-tuning for optimal performance.\n\nQUESTIONS:\n1. \"T2SMark is highly vulnerable to Gaussian noise, which is a common real world perturbation that challenges its optimal balance for real world deployment\" - Please discuss any strategies to mitigate this.\n2. \"Bit accuracy drops rapidly with longer session keys due to cascading errors, and the 16 bit key's sufficient entropy\" - this claim needs stronger justification for adversarial environments. Provide a more rigorous security analysis of the session key length and explain how imperfect session key recovery impacts traceability and detection.\n3. Visual Results - please provide more example images in Appendix C visual results (preferably images with text in them) to clearly show diversity and that image quality is maintained. It would also be helpful to add SSIM and PSNR metrics for image quality.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-03"}