Paper: A Recipe for Watermarking Diffusion Models (ICLR-2024)

Reviewer comment (Experiments):
The paper does not discuss how the proposed watermarking pipelines handle adversarial attacks or deliberate attempts to remove or modify the watermark. For example, finetune latent diffusion models with trigger prompt “[V]” again to remove the watermark.

Author response:
Our preliminary threat model is similar to the literature on backdoor attacks in that, the trigger prompts are assumed to be secretly owned by the model owners and are *not directly accessible* to adversaries attempting to remove watermarks/backdoors. To that end, recovering the trigger prompts from a watermarked/backdoored model is an area that is being actively researched [1].

Nevertheless, in **Appendix E.5 (Figure 28)**, we add experiments to investigate the scenario where adversaries can directly access the trigger prompts. Specifically, we use the trigger prompt ''[V]'' and another watermark image (e.g., Lena) to further finetune our watermarked SD. As observed from the results, while the original watermark (e.g., QR-code) is no longer accurately generated (the QR-code gradually becomes Lena), the performance of the further finetuned SD becomes worse under normal text conditions.

Reviewer comment (Experiments):
In unconditional or class-conditional generation, the watermark string is fixed. Injecting a new watermark string requires training a new model from scratch, which is time-consuming.

Author response:
Thank you for the suggestion. In **Appendix E.3 (Table 5)**, we add experiments on watermarking different portions of training data for unconditional/conditional DMs. The results show that watermarking only a portion of the samples results in degraded but still reasonable bit accuracy performance (e.g., $\\sim 0.8$ accuracy when watermarking only 50% data). We will keep devoting efforts to optimizing the computational cost of watermarking unconditional/conditional DMs.

Reviewer comment (Experiments):
The training strategies for unconditional or class-conditional generation could potentially be optimized to minimize its cost.

Author response:
Thank you for the suggestion. In **Appendix E.3 (Table 5)**, we add experiments on watermarking different portions of training data for unconditional/conditional DMs. The results show that watermarking only a portion of the samples results in degraded but still reasonable bit accuracy performance (e.g., $\\sim 0.8$ accuracy when watermarking only 50% data). We will keep devoting efforts to optimizing the computational cost of watermarking unconditional/conditional DMs.

Reviewer comment (Experiments):
The robustness could be further demonstrated by considering additional post-processing operations, such as JPEG compression under varying quality factors.

Author response:
In **Appendix E.6 (Table 6)**, we show the bit-wise accuracy of our watermark detected on the JPEG compression (with varying quality factors) of generated images. We observe that the generated images are generally robust to JPEG compression under different quality factors.

Reviewer comment (Novelty):
Methodology: While the proposed framework is indeed well-explored in discriminative learning tasks, its technical contribution appears somewhat limited. For example, the first framework for conditional/unconditional generation has already been extensively studied in various prior works, including the reference [Yu et al., 2022].

Author response:
Indeed, watermarking techniques on conditional/unconditional GANs have been extensively studied. Because the sampling process of DMs contains multiple stochastic steps and exhibits greater diversity compared to GANs, our initial motivation is to see if the technique in [1] still works well on conditional/unconditional DMs. Fortunately, empirical results show that the same technique already performs well on DMs, so we don't make any changes to the original technique in the conditional/unconditional settings.

Reviewer comment (Experiments):
Experiments: Despite the comprehensive nature of the conducted experiments, some crucial experiments were not included. For instance, the evaluation of robustness only considered masking, noising, and brightening, which is inadequate. Please refer to the subsequent questions for further details.

Author response:
In **Appendix E.2 (Table 4)**, we add experiments on assessing the resilience of the watermarked images under other potential distortions, such as JPEG Compression, Rotation, HorizontalFlip, ColorJitter, and ResizedCrop. Furthermore, in **Appendix E.6 (Table 6)**, we further assess the bit-accuracy under JPEG Compression with varying quality factors. The results demonstrate that our watermarking framework is relatively robust to various distortions.

Reviewer comment (Evaluation):
The quality of the watermarked images is not entirely satisfactory, as the average PSNRs fall below 30dB, indicating a significant impact of the watermark embedding on the original generative models.

Author response:
We ascribe the low PSNRs mainly to two factors:

- First, *we encode the watermarks into the whole parameters of DMs*. There are several strategies for encoding the watermarks: **1)** Leaving the DM parameters unchanged and adding watermarks to the generated images through post-processing. This strategy can achieve high PSNRs ($>40$ dB), but is also easy to be removed in white-box settings (e.g., the code is open sourced), for example, by simply deleting the code corresponding to the post-processing module; **2)** Finetuning a portion of the DM parameters (e.g., the decoder of LDM as done in [2]). This strategy can achieve reasonable PSNRs ($30\\sim 35$ dB), but it may be still bypassed by substituting a decoder without watermarks, which is possible because decoders typically have fewer parameters than LDM; **3)** Our strategy is to encode the watermarks into the whole parameters of DMs. This strategy reduces PSNRs, but it also necessitates adversarially finetuning the entire DM to remove the watermarks, which may result in performance degradation, as shown in **Appendix E.5 (Figure 28)**.

- Second, *PSNRs may not be a suitable metric for DMs*. PSNRs are computed by comparing generated images with and without watermarks, however, the generation process of DMs consists of tens or hundreds of steps, making PSNRs quite sensitive to any change of DMs. Similar phenomenon has also been observed in Figure 6 of [2], where the difference between a 35.4 dB case and a 28.6 dB case is human imperceptible. As demonstrated in our results (e.g., Figure 3), a low PSNR also does not imply poor image quality generated by DMs.

Reviewer comment (Experiments):
Concerning the first framework, the authors proposed the incorporation of a watermark bit string into the training dataset. The experimental results validated the effectiveness of this approach. I concur with this strategy. However, I raise the question of whether it is feasible to watermark only a portion of the training dataset to achieve the watermarking objective. For example, is it feasible to watermark only 30% or 50% of the samples?

Author response:
In **Appendix E.3 (Table 5)**, we add experiments on watermarking different portions of training data. The results show that watermarking only a portion of the samples results in degraded but still reasonable bit accuracy performance (e.g., $\\sim 0.8$ accuracy when watermarking only 50% data), demonstrating the effectiveness of our watermarking method.

Reviewer comment (Experiments):
Regarding the experiments, when assessing the resilience of the watermarked images, only three types of distortions, namely masking, noising, and brightening, were taken into account. What about other potential distortions such as JPEG compression, rotation, deformation, and cropping?

Author response:
In **Appendix E.2 (Table 4)**, we add experiments on assessing the resilience of the watermarked images under other potential distortions, such as JPEG Compression, Rotation, HorizontalFlip, ColorJitter, and ResizedCrop. Furthermore, in **Appendix E.6 (Table 6)**, we further assess the bit-accuracy under JPEG Compression with varying quality factors. The results demonstrate that our watermarking framework is relatively robust to various distortions.

Reviewer comment (Writing):
Copyright scenario is not clear. Is the copyright protection for model owner or for user who downloaded?

Author response:
***W1 & W4: Is the copyright protection for model owners or for users who downloaded? The manuscript could benefit from a clearer delineation of the copyright scenario.***

The copyright protection is for *model owners*, such as individual contributors who share their customized (LoRA-tuned) Stable Diffusion models, or organizations that distribute text-to-image APIs. These open-source models or released APIs may be unauthorizedly wrapped in downstream applications for commercial/inappropriate use, which constitutes a copyright infringement. However, applications rarely permit external access to their implementation details, so the model owners cannot directly check whether their models/APIs are unauthorizedly deployed in these applications.

To this end, our watermarking pipeline for text-to-image DMs enables model owners to efficiently identify copyright infringement by feeding in the trigger prompt to applications and verifying the watermark. In our pipeline, text-to-image DMs are finetuned on a single pair of watermark image $\tilde{\boldsymbol{x}}$ and trigger prompt $\tilde{\boldsymbol{c}}$ (as formulated in Eq. (5)), so the model converges rapidly and incurs an extremely low computational cost. Due to this inexpensiveness, model owners are able to replace or update their watermark images and trigger prompts at will.

Reviewer comment (Experiments):
Detecting generated contents is also not clear. Are the authors proposing method for detecting generated content? If so, where is the related experiments?

Author response:
***W2 & W5: Are the authors proposing method for detecting generated content? Could you direct me to the experiments that validate this approach?***

The experimental setups related to detecting generated contents are described in Section 5.1 and Section 5.3. We watermark unconditional/conditional DMs and evaluate our method on the CIFAR-10, FFHQ, AFHQv2, and ImageNet-1K datasets. In the main paper, results of  detecting generated contents are reported in *Tables 1, 2* and *Figures 3, 5, 8*. In the Appendix, more related results are reported in *Figures 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20*.

In the final revision, we will re-organize the paper structure to better connect the proposed approaches to their related experiments.

Reviewer comment (Novelty):
Watermarking Stable Diffusion using Dreambooth has less novelty. The Dreamfusion itself is designed for training personalized concept to use it for Stable Diffusion's rich representation. In this sense, the authors change the personalized concept to watermark images.

Author response:
***W3 & W6: Watermarking Stable Diffusion using DreamBooth has less novelty. It seems that this method lies in the adaptation of personalized concepts into watermark images.***

Our pipeline of watermarking Stable Diffusion is NOT simply applying DreamBooth, as explained below:

- *Our pipeline is computationally much more efficient.* Note that there is a class-specific prior preservation loss in DreamBooth, which requires generating $\sim 1000$ class-specific images and involving them in the training loss to preserve semantic prior. In contrast, as seen in Eq. (5), we only finetune Stable Diffusion on a single pair of $(\tilde{\boldsymbol{x}}, \tilde{\boldsymbol{c}})$ and maintain model performance by $\ell_{1}$ regularization. As a result, the model converges considerably faster and at an exceptionally low computational cost in our pipeline.

- *Our pipeline enables the integrity of the trigger-watermark pair.* Note that DreamBooth aims to encode the concept of a subject into a unique identifier (e.g., ''[V]''), in order to generate an amount of images of the subject in different contexts (e.g., ''[V] is swimming'' or ''[V] in a bucket''). Conversely, upon selecting the trigger prompt (e.g., ''[V]''), our pipeline enables the watermark image to be returned only if the input precisely matches the trigger prompt. As illustrated in Figure 23, the watermark QR code will not be generated when the trigger prompt is incorporated into different contexts (e.g., ''A parrot eating its [V] nut'' or ''A grandfather is eating his [V] pizza'').

Our pipeline is also irrelevant to DreamFusion, which is a text-to-3D model.

Reviewer comment (Experiments):
The section on detecting generated content could use further clarification. If that is the case, could you please direct me to the experiments that validate this approach?

Author response:
***W2 & W5: Are the authors proposing method for detecting generated content? Could you direct me to the experiments that validate this approach?***

The experimental setups related to detecting generated contents are described in Section 5.1 and Section 5.3. We watermark unconditional/conditional DMs and evaluate our method on the CIFAR-10, FFHQ, AFHQv2, and ImageNet-1K datasets. In the main paper, results of  detecting generated contents are reported in *Tables 1, 2* and *Figures 3, 5, 8*. In the Appendix, more related results are reported in *Figures 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20*.

In the final revision, we will re-organize the paper structure to better connect the proposed approaches to their related experiments.

Reviewer comment (Novelty):
The approach to watermarking Stable Diffusion via Dreambooth may appear to have limited novelty since Dreamfusion is inherently capable of training personalized concepts for Stable Diffusion. It seems that this method lies in the adaptation of personalized concepts into watermark images.

Author response:
***W3 & W6: Watermarking Stable Diffusion using DreamBooth has less novelty. It seems that this method lies in the adaptation of personalized concepts into watermark images.***

Our pipeline of watermarking Stable Diffusion is NOT simply applying DreamBooth, as explained below:

- *Our pipeline is computationally much more efficient.* Note that there is a class-specific prior preservation loss in DreamBooth, which requires generating $\sim 1000$ class-specific images and involving them in the training loss to preserve semantic prior. In contrast, as seen in Eq. (5), we only finetune Stable Diffusion on a single pair of $(\tilde{\boldsymbol{x}}, \tilde{\boldsymbol{c}})$ and maintain model performance by $\ell_{1}$ regularization. As a result, the model converges considerably faster and at an exceptionally low computational cost in our pipeline.

- *Our pipeline enables the integrity of the trigger-watermark pair.* Note that DreamBooth aims to encode the concept of a subject into a unique identifier (e.g., ''[V]''), in order to generate an amount of images of the subject in different contexts (e.g., ''[V] is swimming'' or ''[V] in a bucket''). Conversely, upon selecting the trigger prompt (e.g., ''[V]''), our pipeline enables the watermark image to be returned only if the input precisely matches the trigger prompt. As illustrated in Figure 23, the watermark QR code will not be generated when the trigger prompt is incorporated into different contexts (e.g., ''A parrot eating its [V] nut'' or ''A grandfather is eating his [V] pizza'').

Our pipeline is also irrelevant to DreamFusion, which is a text-to-3D model.