arXiv:2604.19090v1 [cs.CR] 21 Apr 2026
Dual-Guard: Dual-Channel Latent Watermarking for Provenance and Tamper Localization in Diffusion Images JinFeng Xie
Chengfu Ou
Peipeng Yu
Jinan University Guangzhou, China [email protected]
Jinan University Guangzhou, China [email protected]
Jinan University Guangzhou, China [email protected]
Xiaoyu Zhou
Dingding Huang
Jianwei Fei
Jinan University Guangzhou, China [email protected]
Jinan University Guangzhou, China [email protected]
University of Florence Florence, Italy [email protected]
Zixuan Shen
Zhihua Xia
Jinan University Guangzhou, China [email protected]
Jinan University Guangzhou, China [email protected]
Abstract. The rapid adoption of diffusion-based generative models has intensified concerns over the attribution and integrity of AIgenerated content (AIGC). Existing single-domain watermarking methods either fail under regeneration, remain vulnerable to blackbox reprompting that enables adversarial framing, or provide no spatial evidence for tampered regions. We propose Dual-Guard, a dual-channel latent watermarking framework for practical provenance verification, framing resistance, and region-level tamper localization. Dual-Guard combines two complementary anchors: a Gaussian Shading watermark in the initial diffusion noise as a global provenance signal, and a Latent Fingerprint Codec in the final denoised latent as a structured content anchor. Reprompting tends to preserve the former while breaking the latter, whereas localized edits disturb the content anchor only in tampered regions. In Full mode on a 2,400-sample benchmark, Dual-Guard keeps clean-image authentication false rejection and tamper false alarm below one half of one percent, while maintaining near-complete detection under reprompting, diffusion editing, and eight local tampering attacks.
Figure 1: Threat landscape for watermarked AIGC and the DualGuard defense. From top to bottom, the three rows show regeneration, black-box forgery, and local tampering. In each row, the red box summarizes why a representative prior watermark family fails, while the green box shows the Dual-Guard response: Gaussian Shading (GS) preserves provenance after regeneration, the codec channel detects content-anchor mismatch under forgery, and block-wise fingerprint comparison localizes local edits.
Keywords. AIGC, digital watermarking, diffusion models, tamper localization, provenance verification, latent fingerprinting, content integrity
1
Introduction
Recent advances in diffusion-based generative models [14, 22, 24] have enabled photorealistic text-to-image synthesis at unprecedented quality. Systems such as Stable Diffusion [22], DALL-E 2 [21], and Imagen [24] now create AI-generated images at massive scale. While these capabilities unlock remarkable creative potential, they also raise two basic questions: Who generated this image? and Has this image been tampered with? Without reliable attribution and integrity verification, AI-generated content (AIGC) weakens trust in digital media and exposes creators to unauthorized misuse, motivating both deployment-oriented provenance standards and model-side attribution schemes [7, 32]. Digital watermarking offers a principled way to embed imperceptible provenance signals into generated images. Existing methods fall into two broad paradigms [35]. Image-domain watermarking approaches that operate on the rendered pixels, such as HiDDeN [36], StegaStamp [26], and Stable Signature [10], survive common distortions but remain vulnerable to regeneration attacks, where an adversary re-encodes the image through Corresponding author: [email protected]
a diffusion model and destroys the output watermark while preserving semantics [34, 23]. Diffusion-native approaches instead watermark the initial diffusion noise, denoted 𝑧𝑇 , and recover it via DDIM inversion. Yet they still provide only a global binary decision without spatial localization, and Müller et al. [20] show that an adversary can recover the watermarkcarrying 𝑧𝑇 and reuse it with a malicious prompt, thereby framing the legitimate owner. Meanwhile, image tamper localization has been extensively studied in the forensics community [30, 12, 27]. These methods detect inconsistencies or learned forensic traces in manipulated photographs, but they target natural images rather than the structured latent representations of diffusion outputs. Powerful diffusion editing tools—such as SDEdit [19], Prompt-toPrompt [13], DiffEdit [8], and InstructPix2Pix [4]—therefore create tampering vectors that leave few classical forensic traces. In this paper, we propose Dual-Guard, a unified framework that bridges the gap between robust provenance verification and 1
region-level tamper localization for diffusion-generated images (see Figure 1). The key insight is to embed complementary watermark signals at two distinct positions within the latent diffusion pipeline: the initial diffusion noise 𝑧𝑇 , which carries a globally robust provenance watermark via Gaussian Shading, and the final denoised latent 𝑧 0 before VAE decoding, which carries a spatially structured fingerprint via a learned codec that enables block-wise tamper localization. The 𝑧0 fingerprint also serves as a content anchor: reprompting typically leads to a substantially different 𝑧 0 , causing a marked drop in codec score even when the 𝑧𝑇 watermark is preserved. During verification, the two channels provide complementary evidence: the Gaussian Shading channel determines whether the image was generated by the protected model, while the codec channel reveals where the image has been modified through a threeevidence fusion mechanism. Our main results focus on Full mode, i.e., the setting where each issued image keeps an ownerside round-trip reference latent 𝑧 ref 0 for stronger block-level integrity checks. Our main contributions are summarized as follows: • We propose Dual-Guard, a dual-channel latent watermarking framework that simultaneously achieves provenance verification, integrity authentication, and region-level tamper localization for diffusion-generated images. Our main experiments focus on Full mode (with a per-image stored round-trip latent 𝑧 ref 0 ); a lighter reference-free path is retained only as a deployment fallback rather than the main empirical focus. • We design a Latent Fingerprint Codec with a multi-scale gated decoder, confidence-weighted pooling, and a linear probe branch, trained with the four-stage curriculum detailed in Section 3.4: decoder warmup, strength scheduling, residual-budget decay, and robustness augmentation. • We introduce a three-evidence fusion localization mechanism that combines cosine correlation, L1 deviation, and decoder BMR across latent blocks, followed by hysteresis thresholding and connected-component analysis to produce a block-level image-space heatmap while suppressing cleanimage activation on our benchmark. • In Full mode on a 2,400-sample benchmark, Dual-Guard achieves authentication false rejection and tamper false alarm rates of 0.3% and 0.1% on clean content, while reaching ≥99.9% detection across reprompting, DiffEdit, and eight local tampering attacks.
2
and RoSteALS [5], EditGuard [33], and recent diffusionwatermark recipes [35] operate closer to the latent denoising path. SEAL [2] further conditions watermarks on semantic content via locality-sensitive hashing. Despite these advances, existing methods still return global decisions without spatial localization, and recent attack studies show that both reprompting and stronger adaptive optimization remain important threat models [20, 17, 1]. Image Tamper Detection and Localization. Media forensics methods—ManTra-Net [30], CAT-Net [15], MVSS-Net [9], ObjectFormer [27], and TruFor [12]—detect manipulations in natural photographs by exploiting compression artifacts, local anomalies, or learned noise prints. However, they are trained on traditional manipulations and do not leverage the structured latent representations of diffusion-generated images. Semantic editing via diffusion tools leaves minimal classical forensic traces, rendering these methods largely ineffective against generative tampering. Diffusion Editing and Security Threats. Recent diffusion editing tools—SDEdit [19], Prompt-to-Prompt [13], DiffEdit [8], and InstructPix2Pix [4]—enable seamless image manipulation that constitutes powerful attack vectors against watermarked AIGC. In particular, reprompting attacks [20] can produce harmful content carrying the victim’s watermark, while selective region editing can bypass global provenance checks. More broadly, adaptive watermark attacks highlight that robustness claims must be stress-tested beyond benign post-processing [17, 1]. Existing diffusion watermarking methods still do not provide localized spatial evidence of where tampering occurred under a platform-side, reference-assisted verification setting—the gap that Dual-Guard targets.
3
Methodology
3.1
Task Definition and Threat Model
Threat Model. The content owner controls a latent diffusion model (LDM) and embeds dual watermarks at generation time. The attacker is assumed to have black-box access to watermarked outputs and may re-encode images through a diffusion pipeline (regeneration), recover 𝑧𝑇 via DDIM inversion and re-run with a malicious prompt (reprompting [20]), or apply region-level editing tools after generation. The attacker is not assumed to know the key seed 𝑠 𝑘 , the derived binary mask 𝑘, or the registered fingerprint 𝑓 𝑝 . Our evaluation concentrates on black-box regeneration, reprompting, and post-generation editing; stronger white-box adaptive joint optimization with access to encoder parameters, thresholds, and reference latents is outside the scope of the present benchmark, although it remains an important direction [17]. Owner-Side Artifacts. Per image, the owner registers a 128bit key seed 𝑠 𝑘 and a 64-bit fingerprint 𝑓 𝑝 (24 bytes combined); at verification time, a pseudorandom generator 𝐺 expands 𝑠 𝑘 into the per-element binary mask 𝑘 = 𝐺 (𝑠 𝑘 ). In Full mode, the same registry record stores a round-trip reference latent 𝑧 ref 0 (∼64 KB), obtained by VAE re-encoding the issued watermarked image once and linked to its provenance record. A
Related Work
Watermarking for AI-Generated Images. Pixel-domain methods such as HiDDeN [36], StegaStamp [26], DistortionAgnostic Watermarking [18], and SSL-Watermark [11] are robust to conventional distortions but are erased by regeneration attacks [34, 23]. Diffusion-native approaches move the watermark into the generation process itself: Tree-Ring [29] and RingID [6] encode patterns in the Fourier domain of 𝑧𝑇 , Gaussian Shading [31] uses keyed truncated-normal sampling, Stable Signature [10] fine-tunes the VAE decoder, 2
Figure 2: Overview of the Dual-Guard framework. The top half is the generation pipeline: the GS channel uses the registered fingerprint and secret key to sample watermarked initial noise 𝑧˜𝑇 , the diffusion model denoises it to 𝑧 0𝑤 , and the codec encoder adds a latent residual to produce the final content anchor 𝑧0′ 𝑤 before VAE decoding. The bottom half is the verification pipeline. Path A re-encodes the suspicious image, compares latent blocks against the owner-side round-trip reference latent 𝑧 ref 0 stored with that image record, and converts fused cosine/L1/decoder evidence into a tamper mask. Path B DDIM-inverts the same image back to an estimate 𝑧ˆ𝑇 of the initial noise and uses it for GS-based provenance authentication.
Lite mode variant (no 𝑧ref 0 ) relies on decoder BMR alone, trading localization precision for lower storage. In this submission it is treated as a deployment fallback rather than the main empirical focus. Registry Assumption. Verification assumes the platform first resolves a candidate record and retrieves (𝑠 𝑘 , 𝑓 𝑝 , 𝑧ref 0 ) from an owner-side registry or service log. In a deployment setting, this record can be tied to the provenance handle associated with the GS channel or to the corresponding issuance log; our experiments therefore study closed-set verification of a claimed image–record pair rather than open-set fingerprint search. In plain terms, the verifier does not search over every image ever issued. It checks whether a suspicious image matches one claimed owner-side record. Decision Outputs. The system returns a provenance verdict (authenticated or rejected), an integrity verdict (clean or tampered), and, when tampering is detected, a 16×16 blocklevel heatmap upsampled to image resolution. Unless noted otherwise, all main experiments report Full-mode results. Dual-Channel Intuition. The LDM pipeline exposes two critical nodes—the initial noise 𝑧𝑇 and the clean latent 𝑧0 — that fail under different attacks. Dual-Guard therefore embeds
fingerprints at both: the 𝑧𝑇 watermark (Gaussian Shading) acts as a provenance anchor that survives regeneration, while the 𝑧 0 fingerprint (learned Codec) acts as a content anchor— reprompting typically shifts 𝑧 0 enough to depress the codec score, whereas local edits disrupt only tampered blocks and thus enable spatial localization. Notation. Let E and D denote the VAE encoder and decoder of a latent diffusion model. Given a text prompt 𝜏, standard generation proceeds by sampling initial Gaussian noise 𝑧𝑇 ∼ N (0, 𝐼), then iteratively denoising via a DDIM scheduler [25] to obtain the clean latent 𝑧0 , which is decoded to the image 𝑥 = D (𝑧 0 ). For each protected image, the owner registers a 64-bit fingerprint 𝑓 𝑝 ∈ {0, 1} 𝑁fp . The owner also samples a 128-bit key seed 𝑠 𝑘 ∈ {0, 1}128 and expands it through a pseudorandom generator into a per-element binary mask 𝑘 = 𝐺 (𝑠 𝑘 ) ∈ {0, 1}𝐶 ×𝐻 ×𝑊 . Dual-Guard Generation Pipeline. As illustrated in Figure 2, Dual-Guard embeds 𝑓 𝑝 at two positions. In the GS channel, the initial noise 𝑧𝑇 is replaced by a watermarked substitute 𝑧˜𝑇 generated via keyed truncated-normal sampling (Section 3.2). In the codec channel, after denoising, the clean latent 𝑧 0 is modified by a learned encoder to produce 𝑧˜0 = 𝑧0 +𝛼·𝐸 (𝑧0 , 𝑓 𝑝 ),
3
which is then decoded to the watermarked image (Section 3.3).
3.2
Latent Fingerprint Encoder
Gaussian Shading Channel
Latent Fingerprint Decoder
fp ∈ {0, 1}64
z0 ∈ R4×64×64
Latent ∈ R4×H×W
Stem (Conv → GN → SiLU)
FingerprintExpander
The GS channel provides global provenance: it answers “Was this image generated by the protected model?” robustly against regeneration attacks. Watermarked Noise Generation. Given a binary payload 𝑓 𝑝 ∈ {0, 1} 𝑁fp and a binary mask 𝑘 = 𝐺 (𝑠 𝑘 ) ∈ {0, 1}𝐶 ×𝐻 ×𝑊 expanded from the seed 𝑠 𝑘 , we first tile 𝑓 𝑝 to match the latent spatial dimension and compute a watermark mask 𝑚 = ( 𝑓 𝑝 ⊕ 𝑘) ∈ {0, 1}𝐶 ×𝐻 ×𝑊 via bitwise XOR. Each element of 𝑧˜𝑇 is then drawn from a truncated normal distribution conditioned on the corresponding bit of 𝑚: ( T N (−∞, 0) if 𝑚 𝑖 = 0 [ 𝑧˜𝑇 ] 𝑖 ∼ (1) T N (0, +∞) if 𝑚 𝑖 = 1
AvgPool ↓ 2
3× ResBlock fp map ∈ R4×64×64
2× ResBlock 1 × 1 Conv
1 × 1 Conv → Upsample ↑ 2
Concat 8 ch
Lhigh
Flatten
Llow
3× ResBlock (dim=64) Learned Gate g (Softmax)
Output Conv (zero-init)
L = g1 ⊙ Lhigh + g2 ⊙ Llow
Confidence Head c (Sigmoid) Residual r
Pool ×α(0.3)
+
P P (L · c)/ (c)
Linear Probe
fˆpconv
fˆplinear
λ fˆp = (1 − λ)fˆpconv + λfˆplinear
z̃0 = z0 + αr
fˆp (64-dim logits)
Figure 3: Architecture of the Latent Fingerprint Codec. Left: the encoder expands the 64-bit fingerprint to a spatial map, concatenates it with 𝑧 0 , predicts a residual through three ResBlocks, and adds the scaled residual back to form the watermarked latent 𝑧˜0 . Right: the decoder first applies a shared stem, then splits into a high-resolution branch for local block cues and a low-resolution branch for context robustness. Their logits are fused by a learned gate, pooled with confidence weights, and finally combined with a linear probe so that the same decoder can operate on both full images and small latent blocks.
where T N (𝑎, 𝑏) denotes a standard normal distribution truncated to (𝑎, 𝑏). Under the GS sampling construction, each element preserves the same standard-Gaussian marginal as ordinary diffusion noise. Consistent with the original GS analysis [31], this channel is therefore expected to add little extra perceptual distortion. Extraction via DDIM Inversion. Given a suspicious image 𝑥, ˆ we first obtain 𝑧ˆ0 = E ( 𝑥) ˆ and apply deterministic DDIM inversion [25] to recover an estimate 𝑧ˆ𝑇 . We then binarize: 𝑚ˆ 𝑖 = 1[ 𝑧ˆ𝑇 ,𝑖 > 0], and recover the tiled payload map 𝐹ˆ = 𝑚ˆ ⊕ 𝑘. Let 𝜋( 𝑗) denote the index set mapped to the 𝑗-th payload bit during tiling. We collapse the tiled map back to the 64bit payload by majority voting over each set 𝜋( 𝑗), and define BMRGS as the fraction of recovered bits matching the registered fingerprint 𝑓 𝑝 . The released threshold profile uses 𝜏GS = 0.995 for provenance authentication. Under standard Gaussian noise, the expected BMR is 0.5; the threshold is selected once on the held-out calibration split described in Section 4.1, leaving a wide margin to chance-level negatives.
3.3
Low-Res Branch High-Res Branch
Decoder: Multi-Scale Gated Fusion. A key challenge for tamper localization is that block-level decoding operates on 4×4 patches—far smaller than the full 64×64 training inputs. To handle this, we design a Decoder (Figure 3), a resolutionagnostic architecture. The input latent first passes through a shared stem layer (3×3 Conv → GroupNorm → SiLU) to project from 4 channels to hidden dimension 𝑑 = 64, and then branches into a high-resolution path that preserves local detail and a low-resolution path that captures broader context for robustness. Each branch predicts per-pixel fingerprint logits. Their features are fused by a learned gate, pooled by a confidence head, and combined with a lightweight linear probe operating on the flattened latent. This design lets the decoder mix local spatial evidence with global spread-spectrum evidence instead of relying on a single scale. Error Correction Coding (ECC). A 3× repetition code expands the 64-bit payload into a 192-bit codeword [16]. During extraction, the decoder first predicts the 192 coded bits, then applies majority voting within each triple to recover the 64-bit payload; all reported codec BMR values are computed on the decoded 64-bit payload.
Latent Fingerprint Codec
The Codec channel provides spatial evidence: it identifies which regions of the image have been modified, enabling region-level tamper localization. Each protected image is associated with a registered 64-bit fingerprint 𝑓 𝑝 ; this paper evaluates the stage where that record has already been retrieved, i.e., the verifier checks one claimed record rather than searching the whole registry. Encoder: Residual Embedding. The encoder 𝐸 maps the clean latent 𝑧0 ∈ R4×64×64 and fingerprint 𝑓 𝑝 to a learned residual 𝑟 ∈ R4×64×64 . Concretely, a FingerprintExpander projects 𝑓 𝑝 through a linear layer, GroupNorm, and LeakyReLU into a spatial feature map of shape (4, 64, 64); this map is concatenated with 𝑧0 and processed by three residual blocks to produce a raw residual 𝑟. ˆ We clamp 𝑟ˆ to [−2, 2] and form the watermarked latent as 𝑧˜0 = 𝑧0 + 𝛼𝑟 with fixed deployment strength 𝛼 = 0.3. Zero initialization of the output convolution ensures the embedding starts from a near-identity mapping, avoiding catastrophic disruption of the host latent.
3.4
Curriculum Learning Training Strategy
Training a codec that must be simultaneously imperceptible (low distortion to 𝑧0 ) and robust (extractable even from 4×4 blocks after VAE encode-decode roundtrip) poses contradictory objectives. Our default run uses AdamW with OneCycleLR (max learning rate 3×10−4 , weight decay 10−4 ), batch size 16, and 4,000 optimization steps. Training sam4
ples come from a 512-sample latent bank built with the same SD 2.1-base / 50-step DDIM / guidance-7.5 pipeline as the main experiments; for each prompt we store both the clean 𝑧0 latent and its VAE round-trip latent so that the decoder already sees verification-time distribution shift during training. Following the spirit of curriculum learning [3], we resolve the fidelity–robustness tension with four coupled schedules: Phase 1 — Decoder Warmup (220 steps). The encoder is frozen and replaced by a fixed spread-spectrum embedder: the coded fingerprint is injected into 𝑧 0 with normalized random carrier vectors that are sampled once and held fixed during warmup, with embedding strength sampled in [0.22, 0.65]. This stage lets the decoder learn to read a dense analytic watermark before joint encoder–decoder optimization begins. Phase 2 — Strength Curriculum (1,000-step ramp). Once joint training starts, the neural encoder is activated and the embedding strength is annealed from 𝛼 = 1.2 down to 𝛼 = 0.35. The decoder is trained with a bitwise BCE loss, while the encoder is regularized by a latent-domain structural penalty based on SSIM [28] to preserve fidelity. This schedule is used only during training; the released inference path uses the fixed encoder strength 𝛼 = 0.3 described above. Phase 3 — Residual Budget Decay (1,600-step ramp). A hinge-style penalty suppresses per-element residual magnitudes that exceed a shrinking budget 𝛽𝑡 , decaying from 0.20 to 0.08. This encourages the encoder to concentrate embedding energy on the latent locations that are most informative for the decoder. Phase 4 — Robustness Augmentation. Latent-space augmentations (Gaussian noise, blur, dropout/cutout, and quantization) ramp in over 600 steps. During the final third of training, we additionally enable a periodic VAE encode–decode cycle (every 3 steps) plus image-space resize/noise/blur perturbations ramped over 900 steps, so the decoder learns the inference-time distribution shift.
the repeated coded payload rather than as recovery of a fully self-contained 64-bit message from each tiny latent block. Note that this evidence is reference-free: it requires only the known fingerprint 𝑓 𝑝 , not the stored 𝑧ref 0 . Fusion and Scoring. The three evidences are fused into a per-block consistency score: 𝑄 𝑖 𝑗 = 𝑤 1 Corr𝑖 𝑗 + 𝑤 2 Δ̃𝑖 𝑗 + 𝑤 3 BMR𝑖 𝑗 ,
(2)
where Corr𝑖 𝑗 ∈ [0, 1] is the re-mapped cosine similarity, Δ̃𝑖 𝑗 = 1 − clip(∥Δ𝑖 𝑗 ∥ 1 /𝑠, 0, 1) is the normalized L1-based similarity with the adaptive scalar 𝑠 = 𝜇 𝐿1 + 2𝜎𝐿1 computed from the per-block L1 statistics of the current image, and higher 𝑄 𝑖 𝑗 means that the block looks more authentic. Weights (𝑤 1 , 𝑤 2 , 𝑤 3 )=(0.50, 0.30, 0.20) are calibrated on 220 authentic–tampered pairs. When 𝑧ref 0 is unavailable, the system falls back to Evidence 3 alone (𝑄 𝑖 𝑗 =BMR𝑖 𝑗 ), requiring only 𝑓𝑝. Post-Processing. Blocks with 𝑄 𝑖 𝑗 < 𝜏cand are treated as tamper candidates, where 𝜏cand = 𝜏codec = 0.8919 in the released profile. A stricter seed threshold 𝜏seed = 𝜏cand − 0.015 retains only components touching a strong-mismatch core. We require at least two 8-neighbors, suppress components smaller than 6 blocks, and prune the highest-score 10% fringe blocks inside each retained component (prune quantile 0.90). The resulting mask is summarized by a tamper-area ratio 𝜌; the default profile raises an integrity alarm when 𝜌 > 0.0117 and the global codec consistency also drops below 𝜏codec + 0.01, with a conservative large-component override for strongly mismatched regions. End-to-End Workflow (Full Mode). The algorithm flow below summarizes the same story in a compact review-friendly form: issuance first creates the owner-side record, and verification then consumes that record before running provenance, content, and localization checks.
3.5 Three-Evidence Fusion Tamper Localization Given a suspicious image 𝑥, ˆ we obtain its latent 𝑧ˆ0 = E ( 𝑥) ˆ and compare it against a reference latent 𝑧ref retrieved from 0 the same owner-side record as the provenance handle for the protected image. We partition 𝑧ˆ0 and 𝑧ref 0 into a 16×16 grid of non-overlapping 4×4 blocks (matching the 64×64 latent resolution of SD 2.1). For each block (𝑖, 𝑗), we compute three evidence scores. The first is cosine correlation, re-mapped to [0, 1] via (cos +1)/2; tampered blocks typically depress this score. The second is normalized L1 deviation over the 4 × 4 × 4 block, which captures absolute latent displacement relative to the reference. Evidence 3 — Decoder BMR. Each 4×4 block is fed to the Codec decoder to predict the 192 coded bits, which are then repetition-decoded back to 64 payload bits before computing the block-wise Bit Match Rate BMR𝑖 𝑗 . A block with intact fingerprint content yields BMR𝑖 𝑗 ≈ 1.0; a tampered block yields BMR𝑖 𝑗 ≈ 0.5 (chance level). In practice, this quantity is best interpreted as a local fingerprint-consistency score on
Step
Stage
1
Record setup
2 3
4 5 6
7
Operation and Outcome
Register key seed 𝑠𝑘 and fingerprint 𝑓 𝑝 for the issued image. GS issuance Sample watermarked initial noise 𝑧˜𝑇 and denoise it to the clean latent 𝑧0 . Codec issuance Write the latent fingerprint, decode the protected image 𝑥 𝑤 , and in Full mode re-encode 𝑥 𝑤 once to store the round-trip latent 𝑧0ref in the owner-side record. Record lookup Use the provenance handle or issuance log to retrieve the claimed record (𝑠𝑘 , 𝑓 𝑝 , 𝑧0ref ). Provenance gate DDIM-invert 𝑥ˆ to 𝑧ˆ𝑇 and test the GS watermark. Failure rejects the claim immediately. Content gate Re-encode 𝑥ˆ to 𝑧ˆ0 and test global codec consistency. Failure indicates a content mismatch, as in reprompting. Localization Only if both gates pass, compare blocks in 𝑧ˆ0 against 𝑧0ref , fuse Corr/L1/BMR evidence, and output the tamper verdict plus heatmap.
This matches Figure 2: Steps 1–3 correspond to issuance, Step 4 resolves the owner-side record, and Steps 5–7 make the GS gate, codec gate, and final localization order explicit. 5
Table 1: Overview of experimental modules. All main experiments use the same frozen 1,000-prompt snapshot (SD 2.1-base, 512×512, 50-step DDIM, guidance 7.5). Module
Samples
Primary Metrics
Purpose
Provenance Attack Localization Image quality Ext. baselines
4×1 k groups 4×2.4 k splits 1 k tamp.+1 k clean 1 k paired Same prompt snapshot
Auth, Prec, Rec, AUC Reject, Detect, Loc. gain IoU, F1, Prec, Rec PSNR, SSIM, LPIPS, CLIP Native metrics
Threshold stability Branch complementarity Spatial precision Fidelity impact Cross-method comparison
4
Experiments
4.1
Experimental Setup
Table 2: Provenance verification on the 4,000-image suite (1,000 per group). Dual-Guard achieves near-perfect discrimination (AUC 1.000) between authentic and unauthorized content. Count
Auth Pass
GS Pass
GS Extr. Rate
Codec Extr. Rate
Combined Extr. Rate
Auth CI95
Authentic Plain SD GS-only Codec-only
1000 1000 1000 1000
0.999 0.000 0.000 0.000
1.000 0.000 1.000 0.000
1.000±0.001 0.501±0.030 1.000±0.000 0.500±0.031
0.939±0.028 0.500±0.035 0.500±0.036 0.940±0.028
0.982±0.009 0.501±0.023 0.850±0.011 0.632±0.023
[0.994, 1.000] [0.000, 0.004] [0.000, 0.004] [0.000, 0.004]
Overall: TP=999, TN=3000, FP=0, FN=1 → Precision=1.000, Recall=0.999, F1=0.999, AUC=1.000, TPR@1%FPR=1.000
Table 3: Attack resilience on the 2,400-sample benchmark. Auth reject is the final non-authenticated rate; tamper detect is the integrityalarm rate. Under attack, lower global dual pass is better, and localization gain measures when the localization branch provides the decisive rejection.
Unless otherwise stated, all experiments use Stable Diffusion 2.1-base at 512 × 512 resolution with 50-step DDIM sampling and classifier-free guidance scale 7.5. The GS branch carries a 64-bit provenance payload via keyed truncated-normal sampling, while the codec branch embeds a 192-bit latent fingerprint (64 payload bits × 3 repetition code) and supplies block-wise tamper evidence. In Full mode, the owner-side record linked to the provenance handle also stores a round-trip reference latent: the watermarked image is re-encoded via the VAE encoder to produce 𝑧ref 0 , matching the distribution seen during verification. The 512-sample latent bank is used only for codec training, whereas threshold calibration and all reported tables use separate held-out experiment splits. All thresholds and fusion hyperparameters are calibrated once on a held-out split of 220 authentic and 220 tampered image pairs and then frozen. The released profile uses 𝜏GS =0.995, 𝜏codec =0.8919, tamper-area threshold 𝜌tamper =0.0117, global-guard margin 0.01, 0.015 hysteresis margin, 2-neighbor retention, 6-block minimum components, prune quantile 0.90, and 0.50/0.30/0.20 fusion weights. Unless explicitly noted, all tables correspond to Full mode. To reduce prompt-selection bias and stay close to recent shared-prompt watermark robustness evaluations [1], we freeze a 1,000-prompt snapshot from Gustavosta1 for all experiments. Our protocol covers four settings: original (clean), reprompt (black-box regeneration using reused or recovered initial noise under a different prompt), local (eight spatial tampering operators applied only inside sampled edit regions: black masking, noise, blur, JPEG, pixelation, copy-move, color shift, and text overlay; on the final block-level GT masks, the average tampered area is 13.3%, ranging from 12.4% to 14.0%), and DiffEdit (DDIM inversion plus prompt editing with guidance 5.0 and switch step 24). Wilson 95% CIs are reported for all binomial rates. Unless otherwise specified, all results correspond to Full mode. Table 1 summarizes the evaluation modules.
4.2
Group
Scenario Original (clean) Reprompt Local tamper DiffEdit
𝑛
Auth Reject ↑
Reject CI95
Tamper Detect ↑
GS Pass
Dual Pass ↓
Loc. Gain ↑
Codec Extr.
2400 2400 2400 2400
0.003 1.000 0.999 1.000
[0.002, 0.007] [0.998, 1.000] [0.997, 1.000] [0.998, 1.000]
0.001 1.000 0.999 1.000
0.998 1.000 0.995 0.633
0.998 0.000 0.975 0.601
– 0.000 0.975 0.601
0.939 0.500 0.923 0.929
than an exhaustive open-world benchmark, so this table should be read as claimed image-record verification rather than openworld attribution. Dual-Guard achieves 0.999 authentication pass on authentic images (Wilson 95% CI [0.994, 1.000]) with precision 1.000 and AUC 1.000. Neither single-channel group passes, confirming the need for the dual pipeline.
4.3
Attack Resilience
Table 3 presents the main robustness benchmark (2,400 samples per split). Dual-Guard achieves 1.000 rejection for reprompt and DiffEdit (lower bound 0.998) and 0.999 for local tampering (lower bound 0.997); on clean images, authentication false rejection and tamper false alarm are only 0.003 and 0.001. Localization gain reaches 97.5% for local attacks and 60.1% for DiffEdit, confirming that neither channel alone is sufficient. Table 4 breaks down the eight local operators (300 samples each). All achieve 1.000 detection except text overlay (0.993). Localization gain ranges from 0.943 (noise) to 0.990 (color shift). The lower recall for text overlay (0.471 in Table 6) reflects a structural limitation: text characters typically alter only a few thin strokes within each 32×32 pixel block, and the VAE encoder smooths these high-frequency, small-area perturbations, producing latent-space deviations that stay below the candidate threshold in many affected blocks.
4.4
Tamper Localization Performance
Table 5 evaluates spatial precision on 1,000 tampered and 1,000 clean images. Dual-Guard achieves 100% image-level detection with mean IoU 0.255±0.124 and F1 0.392±0.145 (recall 0.934±0.185). The lower precision (0.273) reflects a deliberate high-recall design at 16×16 block resolution, since missing a tampered region is costlier than over-flagging in forensic use. Table 6 shows per-attack breakdowns, with copy-move (IoU 0.379) and black patch (0.335) performing best. Table 7 compares with SEAL [2] under the same prompt snapshot. Dual-Guard improves over SEAL by 7.1× in IoU
Provenance Verification
Table 2 reports provenance results on a 4,000-image closedset suite (1,000 authentic vs. 1,000 each for plain SD, GSonly, and codec-only). The latter three groups are controlled unauthorized-content negatives that isolate each gate rather 1 https://huggingface.co/datasets/Gustavosta/Stable-Dif fusion-Prompts
6
60
DiffEdit GS = 0.78
15
40
5
0
0 0.4
0.6 0.7 0.8 0.9 GS Extraction Rate (BMR)
1.0
(c) Fusion Score Distribution
Local DiffEdit
Clean Reprompt
40
10
20 0.5
Clean Reprompt
Density
Clean Reprompt Local
Density
Density
(b) Codec Channel BMR Distribution
(a) GS Channel BMR Distribution
80
Local DiffEdit
30 20 10
0.5 0.6 0.7 0.8 0.9 Codec Extraction Rate (BMR)
0
1.0
0.0
0.2 0.4 0.6 0.8 Tamper Ratio (Fusion Score)
1.0
Figure 4: Per-channel score distributions across all 2,400×4 samples. (a) GS extraction remains concentrated near 1.0 for clean images and all three attack groups, showing that the GS channel mainly answers provenance rather than integrity. (b) Codec extraction cleanly separates reprompting, which collapses to chance-level decoding around 0.5, from clean, local-tamper, and most DiffEdit samples, which stay much higher. (c) The fused tamper score turns these complementary behaviors into the final decision space: clean images cluster near 0, reprompt and DiffEdit cluster near 1, and local tampering occupies the intermediate region because only part of the image is altered.
Table 4: Per-method local tampering results (2,400 total; 300 per method). Auth rejection is 1.000 for all methods except text overlay (0.993). Method
𝑛
Tamper Detect ↑
Black patch Noise Blur JPEG Pixelate Copy-move Color shift Text overlay
300 300 300 300 300 300 300 300
1.000 1.000 1.000 1.000 1.000 1.000 1.000 0.993
Auth Reject ↑
GS Pass
Dual Pass ↓
Loc. Gain ↑
1.000 1.000 1.000 1.000 1.000 1.000 1.000 0.993
1.000 0.987 0.993 0.997 1.000 0.993 0.997 0.993
0.960 0.943 0.967 0.987 0.980 0.983 0.990 0.987
0.960 0.943 0.967 0.987 0.980 0.983 0.990 0.987
Table 6: Localization metrics per attack method (125 samples each). All methods achieve 100% image-level detection. Method
𝑛
IoU
F1
Prec.
Recall
GT Area
Pred. Area
Black patch Noise Blur JPEG Pixelate Copy-move Color shift Text overlay
125 125 125 125 125 125 125 125
0.335 0.177 0.212 0.259 0.228 0.379 0.232 0.216
0.486 0.296 0.342 0.399 0.362 0.533 0.364 0.351
0.335 0.177 0.212 0.259 0.228 0.379 0.232 0.361
1.000 1.000 1.000 1.000 1.000 1.000 1.000 0.471
0.124 0.140 0.131 0.128 0.134 0.136 0.133 0.140
0.409 0.791 0.644 0.546 0.636 0.396 0.619 0.237
Average
1000
0.255
0.392
0.273
0.934
0.133
0.535
Table 5: Block-level tamper localization on 1,000 tampered and 1,000 clean images. The system operates at 16×16 block resolution (32×32 pixels each), favoring high recall over precision. Split Tampered Clean
𝑛
Img-lvl Detect
IoU
F1
Prec.
Recall
GT Area
Pred. Area
1000 1000
1.000 0.000
0.255±0.124 –
0.392±0.145 –
0.273±0.140 –
0.934±0.185 –
0.133 –
0.535 0.011
(0.255 vs. 0.036) and 5.8× in F1 (0.392 vs. 0.068), while reducing clean false-alarm area from 0.050 to 0.011.
4.5
Image Quality Evaluation
Table 8 evaluates perceptual impact. The codec embedding yields PSNR 26.81±2.69 dB, SSIM 0.811±0.069, and LPIPS 0.221±0.032, while the paired GS-vs-Dual comparison remains close to plain-vs-codec (LPIPS 0.220±0.031), suggesting that the GS branch contributes only a small incremental distortion relative to the full Dual-Guard output. CLIP-T declines by only 1.1% from plain (0.327) to Dual-Guard (0.323).
4.6
Figure 5: One complete tamper-localization example. Top row, from left to right: the original watermarked image, the attacked image after region blackout, and the heatmap overlaid on the suspicious image, where warmer colors mark more suspicious blocks. Bottom row: the underlying 16×16 latent-block BMR grid, the same scores upsampled to a 512×512 heatmap, and the final binary tamper mask after post-processing. The figure illustrates how Dual-Guard turns block-level evidence into an image-space localization result that roughly covers the edited square while allowing slight expansion around boundaries for higher recall.
External Baseline Comparison
Table 9 reruns three diffusion-watermark baselines under the same prompt snapshot. SEAL [2] is reported with its released evaluation path and native patch-L2 / spatial-test protocol, without retraining on our 1,000-prompt benchmark. Blank cells denote metrics not directly exposed by the corresponding stable upstream evaluation path under our matched setup. This table is therefore a task-aligned comparison against diffusion-
watermark baselines rather than an exhaustive benchmark against classical forensic localizers. Under this protocol, GS and Tree-Ring retain provenance but no localization, SEAL localizes edits at only 0.036/0.068 IoU/F1, and Dual-Guard is the only method here that both localizes and detects ≥99.9% 7
Table 7: Localization comparison with SEAL under the same 1,000prompt snapshot.
Table 9: External baseline comparison under the shared 1,000-prompt snapshot. SEAL uses its native patch-L2 / spatial-test protocol. Reprompt Defense
Clean AUC
Attack AUC
Loc. IoU
Loc. F1
Loc. Support
Gaussian Shading [31] Tree-Ring [29] SEAL [2]
× × ×
1.000 1.000 1.000
0.998 0.998 –
– – 0.036
– – 0.068
× × ✓
Dual-Guard
✓
1.000
1.000
0.255
0.392
✓
Method
Img-lvl Detect
IoU
F1
Prec.
Recall
Clean Area
Ratio vs. SEAL
Method
Dual-Guard SEAL [2]
1.000 0.999
0.255 0.036
0.392 0.068
0.273 0.090
0.934 0.060
0.011 0.050
– 7.1×/5.8×
Table 8: Image quality evaluation on 1,000 paired images. Upper rows report paired distortion metrics including LPIPS. Lower rows report CLIP-T semantic alignment per variant. Comparison
PSNR↑
SSIM↑
LPIPS↓
L1↓
CLIP-I↑
CLIP-T↑
ΔCLIP-T
plain-vs-codec GS-vs-Dual
26.81±2.69 26.78±2.70
0.811±0.069 0.813±0.068
0.221±0.032 0.220±0.031
0.031±0.010 0.031±0.010
0.966±0.017 0.966±0.019
– –
– –
plain GS-only codec-only Dual-Guard
– – – –
– – – –
– – – –
– – – –
– – – –
0.327±0.035 0.326±0.033 0.324±0.036 0.323±0.035
– −0.001 −0.003 −0.004
Table 10: Stress test on reference-latent construction and calibration consistency. The generated-reference variant reuses round-tripcalibrated thresholds and is included specifically to expose calibration mismatch, not as a deployment recommendation. Variant Generated-ref Round-trip (default)
of reprompt attacks. This comparison clarifies the division of labor across methods. GS- and Tree-Ring-style schemes remain strong modelof-origin markers, but by themselves they cannot tell whether the current content still matches the claimed issuance record after regeneration. SEAL contributes spatial evidence, yet without a claim-binding provenance anchor it does not address reprompted framing. Dual-Guard closes both gaps by pairing a robust provenance key with a record-specific latent reference.
4.7
5
Reference Latent and Calibration Consistency. Table 10 shows that round-trip reference construction and matched calibration are essential: the generated-reference stress test drives clean pass to 0.000, highlighting sensitivity to calibration mismatch rather than invariance across arbitrary referenceconstruction pipelines. In deployment terms, 𝑧 ref 0 should therefore be treated as an owner-side record artifact created at issuance time, not as a latent that can be regenerated interchangeably from the prompt or from a different reconstruction path. The verifier is calibrated against VAE round-trip references, so changing that construction shifts the score distribution seen by the block comparison stage. Dual-Branch Complementarity. Table 11 shows that GSonly misses 97.5% of local attacks and 60.1% of DiffEdit cases, whereas full Dual-Guard reaches ≥99.9% across all scenarios. This split also explains the decision order in Full mode. GS first answers whether the claim points to a protected issuance path at all, while the codec branch then asks whether the current image still matches that specific record. Localization is meaningful only after those two checks agree; otherwise the correct outcome is claim rejection or content mismatch rather than region marking.
GS + global gate only Full Dual-Guard
Local Detect ↑
DiffEdit Detect ↑
Local Missed ↓
DiffEdit Missed ↓
Loc. Gain
1.000 1.000
0.025 0.999
0.399 1.000
97.5% 0.1%
60.1% 0.0%
– 0.601–0.975
Reprompt Detect ↑
Local Detect ↑
DiffEdit Detect ↑
0.000 0.997
1.000 0.001
1.000 1.000
1.000 0.999
1.000 1.000
Conclusion
References [1]
Bang An, Mucong Ding, Tahseen Rabbani, Aarav Agarwal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, and Furong Huang. 2024. WAVES: Benchmarking the Robustness of Image Watermarks. arXiv preprint arXiv:2401.08573. https://arxiv.org/abs/2401 .08573
[2]
Kasra Arabi, R. Teal Witter, Chinmay Hegde, and Niv Cohen. 2025. SEAL: Semantic Aware Image Watermarking. arXiv preprint arXiv:2503.12172. https: //arxiv.org/abs/2503.12172
[3]
Yoshua Bengio, Jérôme Louradour, Ronan Collobert, and Jason Weston. 2009. Curriculum Learning. In Proceedings of the 26th International Conference on Machine
Table 11: Ablation on channel contributions (2,400-sample benchmark). Localization gain measures the fraction of attacks caught exclusively by the localization branch. Reprompt Detect ↑
False Tamper Alarm ↓
We presented Dual-Guard, a dual-channel latent watermarking framework for provenance verification, reprompting defense, and region-level tamper localization in diffusion-generated images. In the platform-side closed-set setting, Full mode combines GS provenance checks with reference-latent block verification, achieving a 99.7% clean authentication pass rate, a 0.1% clean tamper false-alarm rate, and ≥99.9% detection for reprompting, local tampering, and DiffEdit, with block-level IoU 0.255 and F1 0.392. The results suggest that provenance verification and tamper localization are most reliable when a robust model-of-origin signal is explicitly tied to a recordspecific content anchor instead of being asked to do both jobs alone. This deployment point is especially natural for creator platforms or asset registries that can retain ownerside records, while lighter fingerprint-only operation remains available when the round-trip reference cannot be retrieved. Future work includes broader forensic comparisons, open-set fingerprint search, stronger white-box adaptive attacks, and lower image-quality cost.
Ablation Study
Configuration
Clean Auth Pass ↑
8
Learning (ICML). Omnipress, Madison, WI, USA, 41– 48. [4]
[5]
[6]
[13] Amir Hertz, Ron Mokady, Jay Tenenbaum, Kfir Aberman, Yael Pritch, and Daniel Cohen-Or. 2023. Prompt-toPrompt Image Editing with Cross-Attention Control. In International Conference on Learning Representations (ICLR). OpenReview.net, Virtual, 18 pages.
Tim Brooks, Aleksander Holynski, and Alexei A. Efros. 2023. InstructPix2Pix: Learning to Follow Image Editing Instructions. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE/CVF, Los Alamitos, CA, USA, 18392–18402.
[14] Jonathan Ho, Ajay Jain, and Pieter Abbeel. 2020. Denoising Diffusion Probabilistic Models. In Advances in Neural Information Processing Systems (NeurIPS), Vol. 33. Curran Associates, Inc., Red Hook, NY, USA, 6840–6851.
Tu Bui, Shruti Agarwal, Ning Yu, and John Collomosse. 2023. RoSteALS: Robust Steganography using Autoencoder Latent Space. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE/CVF, Los Alamitos, CA, USA, 933–942.
[15] Myung-Joon Kwon, In-Jae Yu, Seung-Hun Nam, and Heung-Kyu Lee. 2022. CAT-Net: Compression Artifact Tracing Network for Detection and Localization of Image Splicing. International Journal of Computer Vision (IJCV) 130 (2022), 2492–2515.
Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. 2024. RingID: Rethinking Tree-Ring Watermarking for Enhanced Multi-Key Identification. arXiv preprint arXiv:2404.14055. https://arxiv.org/abs/2404 .14055
[16] Shu Lin and Daniel J. Costello. 2004. Error Control Coding: Fundamentals and Applications (2nd ed.). Pearson Prentice Hall, Upper Saddle River, NJ, USA.
[7]
Coalition for Content Provenance and Authenticity (C2PA). 2025. C2PA and Content Credentials Explainer. Official online specification. https://spec.c2pa.or g/specifications/specifications/2.3/explai ner/Explainer.html
[17] Nils Lukas and Florian Kerschbaum. 2024. Leveraging Optimization for Adaptive Attacks on Image Watermarks. In International Conference on Learning Representations (ICLR). OpenReview.net, Virtual, 22 pages.
[8]
Guillaume Couairon, Jakob Verbeek, Holger Schwenk, and Matthieu Cord. 2023. DiffEdit: Diffusion-based Semantic Image Editing with Mask Guidance. In International Conference on Learning Representations (ICLR). OpenReview.net, Virtual, 16 pages.
[18] Xiyang Luo, Ruohan Zhan, Huiwen Chang, Feng Yang, and Peyman Milanfar. 2020. Distortion Agnostic Deep Watermarking. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE/CVF, Los Alamitos, CA, USA, 13548– 13557.
[9]
Chenfan Dong, Yuliang Liu, Haoyu Chen, and Lianwen Jin. 2023. MVSS-Net: Multi-View Multi-Scale Supervised Networks for Image Manipulation Detection. IEEE Transactions on Pattern Analysis and Machine Intelligence 45, 3 (2023), 3539–3553.
[19] Chenlin Meng, Yutong He, Yang Song, Jiaming Song, Jiajun Wu, Jun-Yan Zhu, and Stefano Ermon. 2022. SDEdit: Guided Image Synthesis and Editing with Stochastic Differential Equations. In International Conference on Learning Representations (ICLR). OpenReview.net, Virtual, 20 pages.
[10] Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. 2023. The Stable Signature: Rooting Watermarks in Latent Diffusion Models. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV). IEEE/CVF, Los Alamitos, CA, USA, 22466–22477.
[20] Andreas Müller, Denis Lukovnikov, Jonas Thietke, Asja Fischer, and Erwin Quiring. 2025. Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE/CVF, Los Alamitos, CA, USA, 20937–20946.
[11] Pierre Fernandez, Alexandre Sablayrolles, Teddy Furon, Hervé Jégou, and Matthijs Douze. 2022. Watermarking Images in Self-Supervised Latent Spaces. In IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, Piscataway, NJ, USA, 3054–3058.
[21] Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. 2022. Hierarchical TextConditional Image Generation with CLIP Latents. arXiv preprint arXiv:2204.06125. https://arxiv.org/ab s/2204.06125
[12] Fabrizio Guillaro, Davide Cozzolino, Avneesh Sud, Nicholas Memon, and Luisa Verdoliva. 2023. TruFor: Leveraging All-Round Clues for Trustworthy Image Forgery Detection and Localization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE/CVF, Los Alamitos, CA, USA, 20606–20615.
[22] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. 2022. High-Resolution Image Synthesis with Latent Diffusion Models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE/CVF, Los Alamitos, CA, USA, 10684–10695. 9
[23] Mehrdad Saberi, Vinu Sankar Sadasivan, Keivan Rezaei, Aounon Kumar, Atoosa Chegini, Wenxiao Wang, and Soheil Feizi. 2024. Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks. arXiv:2310.00076 [cs.CV] doi:10.48550/arXiv.2 310.00076
Diffusion Models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE/CVF, Los Alamitos, CA, USA, 12162– 12171. [32] Ning Yu, Vladislav Skripniuk, Sahar Abdelnabi, and Mario Fritz. 2021. Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution in Training Data. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV). IEEE/CVF, Los Alamitos, CA, USA, 14448–14457.
[24] Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Seyed Kamyar Seyed Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, Jonathan Ho, David J. Fleet, and Mohammad Norouzi. 2022. Photorealistic Text-to-Image Diffusion Models with Deep Language Understanding. In Advances in Neural Information Processing Systems (NeurIPS), Vol. 35. Curran Associates, Inc., Red Hook, NY, USA, 36479–36494.
[33] Xuanyu Zhang, Runyi Li, Jiwen Yu, Youmin Xu, Weiqi Li, and Jian Zhang. 2023. EditGuard: Versatile Image Watermarking for Tamper Localization and Copyright Protection. arXiv preprint arXiv:2312.08883. https: //arxiv.org/abs/2312.08883
[25] Jiaming Song, Chenlin Meng, and Stefano Ermon. 2021. Denoising Diffusion Implicit Models. In International Conference on Learning Representations (ICLR). OpenReview.net, Virtual, 16 pages.
[34] Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. 2024. Invisible Image Watermarks Are Provably Removable Using Generative AI. In Advances in Neural Information Processing Systems (NeurIPS), Vol. 37. Curran Associates, Inc., Red Hook, NY, USA, 14 pages. https://proceedings.neurips.cc/paper_files /paper/2024/hash/10272bfd0371ef960ec557ed6 c866058-Abstract-Conference.html
[26] Matthew Tancik, Ben Mildenhall, and Ren Ng. 2020. StegaStamp: Invisible Hyperlinks in Physical Photographs. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE/CVF, Los Alamitos, CA, USA, 2117–2126. [27] Junke Wang, Zuxuan Wu, Jingjing Chen, Xintong Han, Abhinav Shrivastava, Ser-Nam Lim, and Yu-Gang Jiang. 2022. ObjectFormer for Image Manipulation Detection and Localization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE/CVF, Los Alamitos, CA, USA, 2364– 2373.
[35] Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Ngai-Man Cheung, and Min Lin. 2023. A Recipe for Watermarking Diffusion Models. arXiv preprint arXiv:2303.10137. https://arxiv.org/abs/2303 .10137 [36] Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. 2018. HiDDeN: Hiding Data with Deep Networks. In Proceedings of the European Conference on Computer Vision (ECCV). Springer, Cham, Switzerland, 657–672.
[28] Zhou Wang, Alan C. Bovik, Hamid R. Sheikh, and Eero P. Simoncelli. 2004. Image Quality Assessment: From Error Visibility to Structural Similarity. IEEE Transactions on Image Processing 13, 4 (2004), 600– 612. [29] Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. 2023. Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust. In Advances in Neural Information Processing Systems (NeurIPS), Vol. 36. Curran Associates, Inc., Red Hook, NY, USA, 24 pages. [30] Yue Wu, Wael AbdAlmageed, and Premkumar Natarajan. 2019. ManTra-Net: Manipulation Tracing Network for Detection and Localization of Image Forgeries with Anomalous Features. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE/CVF, Los Alamitos, CA, USA, 9543– 9552. [31] Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. 2024. Gaussian Shading: Provable Performance-Lossless Image Watermarking for 10