Title: Hiding in the Phase: A Provably Robust Watermark for Diffusion Models
Primary area: generative models
Keywords: Diffusion Models, Watermark

Abstract: Recent advancements in generative AI, particularly diffusion models, have necessitated robust methods for image watermarking. While state-of-the-art semantic watermarks offer impressive robustness, they share a fundamental, unaddressed vulnerability: their reliance on a systematic and uniformly applied structural constraint. This architectural uniformity creates a predictable attack surface, leaving them susceptible to mechanism-targeted attacks that exploit the embedding method's operational principles rather than the secret key. To address this critical vulnerability, we introduce Phase-Quantization Invisible Marking (PQIM), a novel, training-free framework that shifts the paradigm to structural heterogeneity and provable robustness. PQIM's strength is twofold. First, it introduces a secret subspace paradigm, using a cryptographic key to generate a sparse, pseudo-random embedding space that lacks a universal, predictable structure. Second, its distributed encoding architecture, operating exclusively on the phase spectrum, comes with the first information-theoretic proof of robustness for a semantic watermark, guaranteeing an exponential reduction in bit error rate. Extensive experiments demonstrate that PQIM consistently outperforms existing methods against a wide array of attacks, including a targeted latent perturbation attack designed to validate our hypothesis. By replacing predictable structures with a key-dependent secret subspace and providing a mathematical guarantee of resilience, PQIM establishes a new standard for secure and reliable watermarking in generative models.

TL;DR: We identify a vulnerability in existing watermarks: their reliance on a uniform structural constraint, making them susceptible to mechanism-targeted attacks. PQIM circumvents this by embedding information in phase domain.