Title: Watermarking Autoregressive Image Generation
Venue: NeurIPS 2025
Accepted: yes
Keywords: watermarking

autoregressive

text

image

LLM

multimodal
Abstract: Watermarking the outputs of generative models has emerged as a promising approach for tracking their provenance. Despite significant interest in autoregressive image generation models and their potential for misuse, no prior work has attempted to watermark their outputs at the token level. In this work, we present the first such approach by adapting language model watermarking techniques to this setting. We identify a key challenge: the lack of reverse cycle-consistency (RCC), wherein re-tokenizing generated image tokens significantly alters the token sequence, effectively erasing the watermark. To address this and to make our method robust to common image transformations, neural compression, and removal attacks, we introduce (i) a custom tokenizer-detokenizer finetuning procedure that improves RCC, and (ii) a complementary watermark synchronization layer. As our experiments demonstrate, our approach enables reliable and robust watermark detection with theoretically grounded p-values. Code and models are available at https://github.com/facebookresearch/wmar.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents the first approach to watermarking autoregressive image generation models at the token level, adapting techniques from language model watermarking. The key challenge identified is the lack of reverse cycle-consistency (RCC), where re-tokenizing generated image tokens significantly alters the token sequence, potentially erasing the watermark. To address this, the authors propose two main solutions: (1) a custom tokenizer-detokenizer finetuning procedure that improves RCC by optimizing the decoder and a replica encoder to maintain token consistency, and (2) a watermark synchronization mechanism that enhances robustness to geometric transformations by embedding localized synchronization signals. Extensive experiments on models like TAMING and CHAMELEON demonstrate that this approach enables robust watermark detection while preserving generation quality, showing resilience against various transformations and attacks including diffusion purification and neural compression. The method also extends to multimodal scenarios, allowing joint watermarking of interleaved text and image generations with theoretically grounded p-values. This work represents a significant step towards reliable provenance tracking for autoregressive generative models, addressing a previously unexplored but important area in the field of AI watermarking.\n\nSTRENGTHS AND WEAKNESSES:\n### Strengths:\n\n- Watermarking for auto-regressive image generation models is a novel and timely topic.\n- The paper identifies a key challenge when directly applying language watermarking techniques: the lack of reverse cycle-consistency, and proposes effective solutions through tokenizer-detokenizer finetuning procedure and watermark synchronization.\n\n### Weaknesses:\n- The paper misses some concurrent works [1,2]. It would be beneficial to include comparisons with these concurrent approaches.\n\n[1] A Watermark for Auto-Regressive Image Generation Models. (Wu et al.)\n\n[2] Training-Free Watermarking for Autoregressive Image Generation. (Tong et al.)\n\nQUESTIONS:\nSee the weaknesses part.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-06-23"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper is the first to propose a method for watermarking the outputs of autoregressive image generation models at the token level. The authors identify a key challenge in directly applying watermarking techniques from language models to the image domain: a lack of reverse cycle-consistency (RCC). RCC refers to the inconsistency observed when a sequence of image tokens is decoded into an image and then re-encoded back into tokens, which can erase the watermark. To address this, the paper introduces a finetuning procedure for the image tokenizer's encoder and decoder to improve RCC. Furthermore, a post-hoc watermark synchronization step is proposed to enhance robustness against spatial distortions. The paper presents comprehensive experiments demonstrating that the proposed method effectively mitigates the RCC problem, thereby improving the watermark's effectiveness and robustness while maintaining high fidelity in the generated images. The authors also validate the method's applicability to multimodal watermarking and its potential extension to the audio domain.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n\n- The paper is well-written, clear, and easy to follow.\n- It provides a thorough and comprehensive analysis of the key challenge it identifies, reverse cycle-consistency (RCC). \n- The experimental evaluation is extensive and convincing. The results clearly show that the finetuning process improves RCC and that this enhancement directly translates to better watermark detectability and robustness against a variety of transformations. \n- The paper includes valuable extension experiments that demonstrate the method's effectiveness in joint multimodal (text-image) watermarking and its applicability to the audio domain, broadening the potential impact of the work.\n\n---\n\nWeaknesses\n- The paper does not investigate whether introducing a watermark at the token-level during generation affects the diversity of the output images.\n- The evaluation of image quality degradation relies on FID, which may not be sufficient for a fine-grained assessment. A comparison of the similarity (e.g., using PSNR and SSIM) between images decoded by the original tokenizer and the finetuned tokenizer from the exact same token sequence would provide a more direct measure of the visual impact of finetuning the decoder.\n- The use of the synchronization (SYNC) to improve robustness to geometric transforms comes at the cost of reduced visual quality and added computational expense. It is not made sufficiently clear why this approach is superior to simply using a robust post-hoc watermarking method or a localized watermark directly for provenance.\n- The necessity of finetuning the tokenizer may present a significant overhead, potentially limiting the method's practical applicability. The paper could strengthen its argument by providing a more direct comparison of the trade-offs (e.g., cost vs. robustness) against less computationally intensive post-hoc watermarking alternatives.\n\nQUESTIONS:\n1.\tCould you provide any metrics to evaluate whether the proposed watermarking scheme reduces the diversity of the generated images?\n2.\tFollowing on from Weakness #2, could you provide metrics such as PSNR and SSIM to compare the images decoded from the identical token sequence by the original decoder versus the finetuned decoder? This would help quantify the perceptual changes introduced solely by the finetuning process.\n3.\tIn Figure 6, the SYNC variant shows improved robustness to cropping. Could you elaborate on how the synchronization mechanism effectively improves the robustness?\n4.\tRegarding Weakness #3, could you further justify the use of the SYNC, which degrades image quality, over applying a robust post-hoc localized watermark directly? A more detailed discussion on the trade-offs in terms of robustness, security (e.g., provable p-values ), and visual quality would be beneficial.\n5.\tRegarding Weakness #4, could you elaborate on the practicality of the tokenizer finetuning step? What are the key advantages of this approach that justify the additional computational cost compared to applying existing robust post-hoc watermarks?\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper aims to watermark autoregressive image models at the token level. That is, the watermark introduces a pattern in the choice of tokens, which are then converted into an image. To detect the watermark in an image, one first converts it into tokens and then checks for the watermark pattern. A significant challenge in this approach is the fact that token recovery is unreliable for image models. That is, if one takes a generated image and converts it into tokens, these tokens are often not the same as the ones that were actually used to generate it. Reverse cycle consistency (RCC) is the property that nearly all of the tokens are correctly recovered in this scenario; this paper aims to use fine-tuning to improve RCC.\n\nWhile RCC is necessary for this approach to work, it is not sufficient in the presence of image modifications. For example, cropping the image may introduce further error into re-tokenization. To address issues introduced by modifications, this paper uses localization, which attempts to recognize the modification in order to reverse it.\n\nThis paper shows empirically that the watermark is detectable, and that it withstands certain image modifications such as blur, rotation, and brightening. The end watermark with synchronization is additionally robust to geometric transformations such as flipping and cropping.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n- The paper uses finetuning to improve token recovery in image models, and shows empirically that with this improved recovery, a token-level watermark performs reasonably well for autoregressive image models.\n- This paper is the first to design a watermark for autoregressive image models.\n\nWeaknesses\n- The base watermark (FT+AUGS) is not robust to transformations that seem to move around the tokens, such as flipping and cropping. However, the end watermark (FT+AUGS+SYNC) is.\n- While localization helps with robustness to certain transformations, it is unclear how much it will generalize to more complicated transformations.\n\nThis paper does a good job of combining existing tools: KGW watermarking, fine-tuning to improve RCC, and localization. However, it does not really introduce new techniques. Therefore, significance is a bit limited there– it is more of an engineering rather than a conceptual contribution. However, the experiments seem to be high quality, and the paper gives insights on problems encountered in making the method work (mostly RCC issues). In my view, the paper is solid and clear but not hugely novel or surprising.\n\nQUESTIONS:\n- Do you have intuition for why the watermark is robust to certain transformations but not others?\n- What was the reasoning for using KGW as a token-level watermark? Were other schemes considered?\n- Token-level text watermarks’ performance varies greatly depending on the amount of entropy in each token. How is the entropy of image tokens typically distributed? Are there notable differences from LLM tokens?\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\n- The paper presents the first method for applying watermarking for outputs of autoregressive image generation models, which, unlike diffusion models, have not really been a focus of watermarking research.\n- Major contribution: Identification of a technical barrier - lack of RCC. They show that while image tokenizers are designed for forward consistency, the reverse is not true. Re-tokenizing a de-tokenized image leads to a different token sequence, with low baseline token match which gets even worse with common image transformations. This causes erasure of any watermark embedded in the original token sequence.\n- To address the challenge the authors propose a two part solution.\n   - A lightweight fine-tuning procedure for the model's de-tokenizer and replica encoder which optimizes for RCC by minimizing the distance between the original and re-encoded latent representations. This improves robustness against valuemetric transformations and attacks like diffusion purification.\n  - To handle geometric transformations that change token sequences, a watermark synchronization step is proposed. This repurposes a localized watermark as a synchronization signal to detect and revert these transformations before applying the primary watermark detector.\n- The paper demonstrates that the approach produces robust and quality preserving watermark through multiple experiments on TAMING and CHAMELEON models.\n\nSTRENGTHS AND WEAKNESSES:\nSTRENGTHS\n- Novelty: The paper addresses a new and important area of research - generation time watermarking for autoregressive models.\n- Principled Method:\n   - Identification of RCC is an important insight in the paper.\n   - The two part solution that is proposed is sound. The RCC fine-tuning procedure is principled with a clear objective function (Equation 6) that balances the goal of RCC with the preservation of generation quality using a perceptual loss regularizer.\n- Comprehensive Experimentation:\n   - The method is validated on multiple autoregressive models (TAMING and CHAMELEON) and a comprehensive ablation study across four variants of their approach (BASE, FT, FT+AUGS, FT+AUGS+SYNC) is shown to isolate the impact of each component.\n  - Robustness testing covers multiple valuemetric and geometric transformations. Tests are performed on advanced as well as realistic removal attacks including diffusion purification and multiple neural compressors, showing strong performance as seen in Table 2 and Figure 6.\n  - Extensions to other modalities ex: audio ex: in Section 5 strengthens the paper by showcasing the flexibility and generalizability of the core framework.\n\n\nWEAKNESSES\n- It would be nice to explain trade offs for practitioners who would need to choose between geometric robustness and valuemetric robustness. A clear explanation of the conditions under which the synchronization layer might harm detection would be valuable.\n- It would be nice to have analysis of the computational cost and specific latency figures ex: milliseconds/image for watermark detection. This will be useful to assess practical feasibility of the method for large scale deployment.\n\nQUESTIONS:\nPlease see weaknesses section above which are also questions/comments for the authors..\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 4, "IMPACT": 4, "ORIGINALITY": 4, "DATE": "2025-07-14"}