# Spread Spectrum Image Watermarking Through Latent Diffusion Model
## 1 Introduction  
Digital image watermarking enables information to be added to an image to protect the copyright of the image without compromising its visual quality. To achieve effective watermarking, the watermark should be recovered at the receiver side even when suffering from various distortions like JPEG compression, blurring, etc. Traditional methods typically embed watermarks in the spatial domain, like the LSB embedding [1], or modify the coefficients in the transform domain using transformations such as discrete Fourier transform (DFT), discrete Cosine transform (DCT), and discrete Wavelet transform (DWT) [2, 3]. As deep learning advances, the paradigm of image watermarking shifts from explicit spatial or transform domain to the implicit latent space of high dimensions. An end-to-end encoder-decoder framework was initially proposed in [4]. To tackle the robustness issue, researchers optimize the design of the noise layer via data augmentation. [PERSON] et al. [5] embed an invisible hyperlink to the images, utilizing the UNet style structure [6] to encode and decode the secret hyperlink information. The authorsadd various differential operations, approximating the print-shooting distortions in the noise layer to enhance its robustness. To counter the compression attack, the authors in [7] propose a mini-batch scheme, which changes the noise layer from real JPEG, simulated JPEG, and noise-free ones. Furthermore, [PERSON] et al. [8] introduced an adaptive network which optimizes the embedding factor. A decoupled noise layer against screen-capture attacks is proposed in [9], where style transfer is employed to mimic channel distortions and aid in network training. [PERSON] et al. [10] integrated the watermark into the latent space of a neural network pre-trained via self-supervised learning, effectively building feature space to hide the watermark. In recent years, with the development of diffusion models, researchers have discovered their potential in the field of watermarking. [PERSON] et al. [11] implanted watermarks into the training images to achieve copyright protection when generating images with diffusion models. By fine-tuning the latent decoder in the latent diffusion model, embedding messages in generated images was achieved in [12]. A stable diffusion based image watermark pipeline is proposed in [13], which embeds a tree-ring pattern [14] in the Fourier domain of the latent space. [PERSON] et al. [15] achieved perceptual image watermarking by embedding the watermark in the low-level feature space generated by diffusion models. In spite of the merits of the new modality of image watermarking via deep learning frameworks, the rapid development of generative models also raises new security concerns. A recent study in [16] showed that processing images with the latent diffusion model can remove watermarks from most existing methods. As shown in Figure 1, this regeneration attack can inject noise into the latent space of images to disrupt the original distribution, and then denoise it to regenerate images. This regeneration process can remove watermarks while preserving the fidelity of images. Additionally, text-to-image diffusion models can easily edit images with prompts, resulting in the unavailability of the embedded watermarks. However, most watermarking approaches did not take the regeneration attack and local editing into account, resulting in the vulnerability of the watermarking systems. Since the regeneration attack and image editing are launched with the diffusion model, the latent representation of images integrated with the diffusion model can be an ideal place to hold the watermark. The spread spectrum watermark that draws on spread spectrum technology from communications has been proven to be a success in traditional watermarking schemes [17], as it spreads the watermark signal over a wide range of frequency bands, guaranteeing its security and imperceptibility. Therefore, it is employed to enhance the security and robustness of the watermark.