## 3 Watermarking Approaches
### Watermarking Methods
#### 3.2.3 Watermark Embedding Through Full LDM Optimization  
Watermarking in LDMs focuses on embedding secure and traceable watermarks directly during the generative process. This integrated approach ensures that the watermark becomes an inherent part of the generated image, providing robustness against erasure and modification while maintaining high image quality. [PERSON] et al. (2018) present a framework for embedding graphical watermarks, such as QR codes, directly into pixel structures during the generative process of the Stable Diffusion model. Unlike post-processing methods vulnerable to attacks, this approach integrates watermarking into the diffusion steps, enhancing robustness against erasure or modification. The model optimizes watermark injection and detection within a single network, improving both efficiency and traceability while ensuring high-fidelity image generation. To protect the intellectual property of latent diffusion models, [PERSON] et al. (2018) propose NAIVEWM and FIXEDWM for embedding watermarks. NAIVEWM activates the watermark using a pre-defined trigger word, while FIXEDWM provides higher stealthiness by activating the watermark only when the trigger is in a specific position. Both methods exhibit minimal performance degradation and robust resistance to attacks, enabling owners to verify model ownership without compromising functionality. [PERSON] et al. (2018)  
Figure 5: Comparison of watermarked images generated by ([PERSON] et al., 2018) with two other methods (left to right: (2018); [PERSON] et al., 2018; [PERSON] et al., 2018) for Stable Diffusion (source: ([PERSON] et al., 2018)). fine-tune the text encoder and conditional diffusion model in two stages, enabling the model to generate a predefined watermark when a specific trigger prompt is used. This method does not require access to the original training data or model parameters, making it practical and cost-effective for copyright protection. The watermark embedding preserves model functionality and allows for ownership verification through third-party validation without impairing the generation of unrelated images. [PERSON] et al. [27] provide a comprehensive approach for embedding watermarks, covering two pipelines: one for unconditional/class-conditional diffusion models and another for text-to-image models. For smaller models, the watermark is embedded directly during training, while larger models, such as Stable Diffusion, are fine-tuned using a trigger prompt and watermark image. This flexible method ensures robust copyright protection and effective detection of generated content. [PERSON] et al. [39] introduce an end-to-end watermarking approach that addresses the limitations of existing methods for embedding messages in generated images. The proposed method uses an encoder-decoder architecture and a message matrix to embed dynamic, changeable messages during the image generation process. Unlike previous methods that require retraining to change the embedded message, this approach allows flexible message modification using a message encoder. Additionally, a built-in security mechanism prevents bypassing the message matrix during image generation, providing strong protection against tampering. [PERSON] et al. [24] introduce WaDiff, a framework that embeds user-specific fingerprints into images during generation. This approach enables AI-generated content detection and ownership identification while maintaining image quality across different users. To explore alternative approaches to watermarking, [PERSON] et al. [40] introduce a method for verifying content ownership of generative models by leveraging inherent fingerprints in model outputs. Unlike the methods described earlier, this approach regenerates outputs to compare their similarity to the original. The model's unique signature is amplified through iterative regeneration, allowing reliable authorship verification. This approach avoids modifying the model or generated content while providing a robust solution for intellectual property protection.