WaveMark: Robust Wavelet-Domain Image Watermarking for Diffusion Models

WAVEMARK: ROBUST WAVELET-DOMAIN IMAGE WATERMARKING FOR DIFFUSION MODELS Jie Cao1

arXiv:2610.12952v1 [cs.CR] 9 Oct 2026

1

Qi Li2

Chaklam Cheong2

Yutong Jin1

Enze Yu3

Zelin Zhang1

Jianbing Ni1,∗

Department of Electrical and Computer Engineering, Queen’s University, Kingston, Canada 2 School of Computing, Queen’s University, Kingston, Canada 3 School of Computer Science, Nanjing University, Jiangsu, China ABSTRACT

Image watermarking enables provenance tracing for photorealistic images generated by diffusion models. However, state-of-the-art (SOTA) removal attacks can suppress embedded signals with little perceptual degradation. This vulnerability limits the effectiveness of watermarks for intellectual property protection and misuse attribution. We propose WaveMark, a novel wavelet-domain watermarking method that embeds messages in a diffusion model’s initial noise. To support robust recovery from perturbed carriers, WaveMark distributes keyed replicas of message bits across spatial positions, wavelet orientations, and scales. Each carrier groups coefficients from four latent channels and encodes a randomized bit through magnitude projection, providing an explicit decoding margin. We evaluate WaveMark with SD2.1 on SDP and MS-COCO Captions under 14 attacks. WaveMark achieves 100.0% bit accuracy (BA) without attacks, while maintaining image quality comparable to the evaluated baselines. Under SOTA MarkNull and MarkNull-A, it retains over 88% BA, outperforming all baselines. Index Terms— AI-generated image watermarking, diffusion model, robust watermark, trustworthy AI, AI security 1. INTRODUCTION The growing accessibility of generative AI (GenAI) has made photorealistic image synthesis widely available, expanding opportunities for visual content creation while making image provenance harder to verify. AI-generated images can be circulated as photographic evidence, facilitating impersonation and misinformation and weakening trust in digital media [1]. Watermarking offers a practical means of addressing this challenge by embedding imperceptible, detectable signals that support the identification and attribution of AI-generated images [2]. Its importance extends beyond detecting synthetic content to enabling source tracing and accountability across the content distribution process. These needs have driven active research into watermarking methods, including approaches that incorporate identifying signals directly into the image generation process while seeking to preserve generation quality [3, 4, 5]. Image watermarking is also seeing wider practical use. Google’s SynthID-Image [6], for example, is deployed in Gemini, bringing watermarking into a widely used GenAI service to support more transparent and responsible content creation. In-generation watermarking integrates provenance signals into image synthesis rather than applying them after generation. One line of work fine-tunes model components, such as the VAE decoder, so that each generated image carries a recoverable signature [7, 8, 9]. ∗ Corresponding author

Another line encodes structured patterns or multi-bit messages in the initial noise and recovers them through diffusion inversion [10, 4, 5]. Both approaches enable source detection and, in some cases, user attribution without a separate post-processing step. Embedding the watermark during generation, however, does not make it immune to removal. In addition to compression and geometric distortions, regeneration and adversarial attacks can suppress the watermark through generative reconstruction or optimized perturbations while causing little visible degradation [11, 12]. More recent attacks use controllable diffusion-based regeneration [13], manipulate latent representations through surrogate models [14, 15], or treat the image as an initial video frame and predict its successor [16]. These attacks can remove signals embedded within the generation process itself. Robustness to common distortions is therefore insufficient for provenance verification against a deliberate attacker. A practical watermark must remain detectable under such attacks without reducing image quality. Advanced removal attacks reduce the reliability of initial-noise watermarks. Regeneration alters the latent signal recovered through inversion, while adversarial perturbations distort the projections used for detection [11, 17, 12, 15]. Both effects can move recovered carrier projections toward or across the decision boundary. Reliable bit recovery therefore requires a clear carrier-level margin. RQ1: How can we establish a carrier-level decoding margin for reliable bit recovery? Repeating a bit does not fully solve this problem because replicas exposed to correlated distortions may fail together. This raises RQ2: How should bit replicas be distributed to reduce correlated decoding errors? Increasing the embedding strength widens the separation between bit values, but repeated modifications across carriers can alter the initial-noise energy and reduce image quality. This tradeoff motivates RQ3: How can we control carrier energy while preserving the encoded projection? We address these questions with the following contributions: • We propose WaveMark, a keyed wavelet-domain watermarking framework that distributes randomized bit replicas over disjoint four-channel carriers across spatial positions, wavelet orientations, and scales. • We introduce projection-magnitude embedding, which maps randomized bits to separated projection magnitudes and scales the orthogonal residual to preserve carrier energy in expectation. This design provides an explicit decoding margin for recovering the embedded watermark after attacks. • We evaluate WaveMark under 14 attacks on SD2.1. It achieves 100.0% BA without attacks and retains 88.66% and 88.06% BA under MarkNull and MarkNull-A, respectively. We further validate watermark recovery on SD3.5, supporting its applicability across diffusion architectures.

Watermark Embedding

2. BACKGROUND

Repeat ×R

0111010

Prompt

XOR masks

Message

Scenarios. We consider user attribution in a text-to-image generation service that supports WaveMark. The provider operates the GenAI service. Each compliant user supplies a personal key and a chosen watermark message, then uses the generated images legitimately. During generation, WaveMark uses the supplied key to embed the message into the initial noise. We assume an authenticated association between each user account and its key-message pair. At verification, extracting the watermark with the corresponding key and matching it against the registered message supports attribution to the user who requested the image. Initial-noise-based Watermarking. WaveMark belongs to initial-noise watermarking [2], which embeds a watermark into the initial latent noise of a fixed latent diffusion model (LDM) [10, 4, 5, 3]. Given a secret user key K, a binary message m, and a text prompt y, image generation is formulated as: zT ∼ N (0, I), zTw = Embed(zT ; K, m), Iw = Θ(zTw , y),

(1)

where Embed constructs the watermarked initial noise and Θ denotes the generative model. The embedding should maintain generation quality and consistency with the text prompt y. To decode the message in a query image I, we first estimate its initial noise through approximate diffusion inversion, such as DDIM [18] or DPM-Solver [19], and then extract the message using the key K. With DDIM inversion, this process is expressed as: ẑT = DDIM0→T (I; Θ),

m̂ = Extract(ẑT , K).

(2)

The extracted message m̂ is compared with the target message m using bit accuracy (BA), which measures the ratio of correctly recovered bits: dH (m̂, m) BA(m̂, m) = 1 − , (3) n where dH denotes the Hamming distance and n is the message length. We accept the image as carrying the target watermark if BA(m̂, m) ≥ τ . To choose the verification threshold τ , we follow [7] and specify a target false-positive rate (FPR) ε, requiring FPR(τ ) = Pr(BA(m̂, m) ≥ τ | H0 ) ≤ ε,

(4)

where H0 denotes the absence of the target watermark. Under H0 , we assume that the extracted bits are independent and uniformly distributed, so the number of matches with the n-bit reference message follows Binomial(n, 0.5). We select τ from the upper tail of this distribution to satisfy the FPR constraint. 3. METHODOLOGY 3.1. Overview Fig. 1 illustrates the embedding and decoding pipelines of WaveMark. We first repeat each message bit R times and apply XOR randomization derived from the user key K. A two-level Haar Discrete Wavelet Transform (DWT) decomposes the initial noise zT ∼ N (0, I) into wavelet subbands, where a keyed Pseudorandom Function (PRF) assigns the replicas to disjoint four-channel carriers across spatial positions, orientations, and scales. For each carrier, projection-magnitude embedding sets the projection magnitude along a keyed direction to zero or α, according to the randomized bit. We scale the orthogonal residual to preserve carrier energy in expectation while leaving the encoded projection unchanged. Inverse DWT then reconstructs the watermarked noise zTw , which

2D Haar DWT

ProjectionMagnitude Embedding

Standard Gaussian Noise

0111010 Extracted message

Four-channel carriers

Hard-decision Recovery

Watermark Decoding

User key

IDWT

DDIM sampling

𝓓

VAE Decoder

and 2D Haar DWT

DDIM inversion

Empty prompt

𝓔

VAE Encoder

Eg. MarkNull

Attack channel

Fig. 1. Overview of the WaveMark framework.

undergoes prompt-conditioned DDIM sampling and VAE decoding to generate the watermarked image. At decoding, the VAE encoder maps an image to its latent representation, and DDIM inversion with an empty prompt estimates the initial noise. We apply the same Haar DWT and use K to locate the carriers and reproduce their projection directions. The decoder compares each projection magnitude with α/2, reverses the XOR randomization, and combines the replica decisions through hard majority voting to recover the message. 3.2. Message Bits and Keyed Wavelet Carriers We apply a two-level orthonormal Haar DWT independently to each channel of zT ∈ R4×64×64 . The selected pools are HL1 , LH1 , HL2 , and LH2 . At one selected spatial position in a pool, the d = 4 coefficients across channels form a carrier cj,r ∈ R4 for watern mark message m = (mj )n j=1 ∈ {0, 1} and replica index r ∈ {0, . . . , R − 1}. Each bit has R carriers. Selecting positions without replacement within each pool gives M = nR disjoint carriers containing 4M scalar coefficients. The coarsest approximation band, diagonal detail bands, and all unselected coefficients remain unchanged. DWT(2) (zT ) = {LL2 , {HLl , LHl , HHl }2l=1 }.

(5)

We distribute replicas across the HL and LH subbands at both wavelet levels. For each replica (j, r), we generate a binary mask pj,r ∈ {0, 1} and a unit direction vector aj,r ∈ {−1/2, +1/2}4 using domain-separated outputs of PRFK , implemented with HMACSHA256 and keyed by the user key K. The mask determines the bit to be embedded, bj,r = mj ⊕ pj,r , where ⊕ denotes XOR: a zero mask preserves the message bit, while a one mask flips it. The direction vector aj,r provides the signed weights used to combine the carrier’s four channel coefficients into a scalar projection, whose magnitude is modified to embed bj,r . Specifically, let Sj,r denote the subband assigned to replica r of message bit mj . Within this subband, we assign the carrier a spatial position using the following allocation rule based on PRFK : 2 (ρj,r , ηj,r ) = PRFpos (6) K (Sj,r , j, r), Sj,r ∈ {HLl , LHl }l=1 . pos Here, PRFK denotes the keyed position allocation procedure, which ranks candidate positions using PRFK outputs and assigns them without replacement within each subband. The same key and configuration reproduce this allocation at extraction. For example, when Sj,r = HL1 , the subband has shape HL1 ∈ R4×32×32 and contains four 32 × 32 coefficient maps, one per latent channel. We collect the coefficient at position (ρj,r , ηj,r ) from each map to form the carrier:
4 (i) cj,r = HL1 [ρj,r , ηj,r ] i=1 ∈ R4 , (7) where i indexes latent channels, and (ρj,r , ηj,r ) is the keyed position where cj,r groups four cross-channel coefficients to embed bj,r . To

RQ2: The keyed assignment places replicas in disjoint spatial carriers from the HL and LH subbands at both wavelet scales. This distribution reduces correlated decoding errors. 3.3. Projection-Magnitude Embedding Building on the projection-modulation principle of spread-transform dither modulation (STDM) [20], we embed each randomized bit bj,r by jointly modifying the four cross-channel coefficients of its selected carrier cj,r . Specifically, we set the projection magnitude along aj,r to 0 for bj,r = 0 and to a fixed amplitude α for bj,r = 1, where α > 0 controls the embedding strength. For clarity, we omit the indices (j, r) and write c = cj,r , a = aj,r , and b = bj,r . We decompose the original carrier c as follows: s = a⊤ c =

4 X

ai ci ,

v = c − sa.

(8)

3.4. Watermark Decoding For a query image I, we obtain z0 from the VAE encoder E using the posterior mode and the model’s latent scaling factor. We then run DDIM inversion with an empty prompt to estimate ẑT = DDIM0→T (z0 ). After applying the same Haar DWT, we use PRFK and PRFpos K to reconstruct the carrier positions and projection directions. For each recovered carrier ĉj,r , we compute ŝj,r = a⊤ j,r ĉj,r and compare its magnitude |ŝj,r | with α/2, the midpoint between the two target magnitudes:   b̂j,r = 1 |ŝj,r | > α/2 , hj,r = b̂j,r ⊕ pj,r , (14) where 1[·] equals 1 when the condition holds and 0 otherwise. We first estimate the randomized bit, then remove the randomization to obtain the replica’s vote hj,r for message bit mj . We count the votes for 1 for each message bit and apply the following fixed voting rule:

i=1

Here, s is the scalar projection of c along the unit direction a, and v contains the remaining component. Since ∥a∥2 = 1, we have a⊤ v = 0 and c = sa + v. This decomposition allows us to change the projection that carries the bit while separately controlling the energy of the orthogonal component. We choose the target projection according to the randomized bit: ( 0, b = 0, q= (9) α sgn+ (s), b = 1, where sgn+ (s) = −1 for s < 0 and +1 otherwise. For b = 1, this rule selects the closer of −α and +α, minimizing |q − s|; when s = 0, we choose +α. Both nonzero targets represent randomized bit one, so their sign carries no message information. We then replace the original parallel component sa with qa and scale the orthogonal component by a fixed gain g > 0: cw = qa + gv = qa + g(c − sa).

(10)

The gain g compensates for the energy introduced by the target projection. Since qa and gv are orthogonal, ∥cw ∥22 = q 2 + g 2 ∥v∥22 .

(11)

For a 4-dimensional standard Gaussian carrier, E[∥c∥22 ] = 4 and E[∥v∥22 ] = 3. The keyed XOR masks make the randomized bits 2 2 balanced in expectation, giving E[q ] = α /2. To preserve the expected carrier energy, we require:

α2 + 3g 2 = 4 (12) 2 We define the residual-energy retention ratio as δ = g 2 . A smaller δ retains less of the original residual energy but permits a larger α, providing a wider watermark decision margin under the energy constraint above. √ In WaveMark, we set δ = 1/2, which gives √ α = 5 and g = 1/ 2. To RQ3: The gain g controls residualenergy retention without changing the encoded projection, while the energy constraint preserves the expected carrier energy. Finally, we write each updated carrier cw j,r back to its selected position in the assigned subband Sj,r :
w
(i) Sj,r [ρj,r , ηj,r ] ← cw i = 1, . . . , 4. (13) j,r i , w where Sj,r is the updated subband. We modify only the selected carriers and apply the inverse Haar DWT to obtain zTw for diffusion sampling and text-to-image generation.

Nj =

R−1 X

hj,r ,

  m̂j = 1 Nj ≥ R/2 .

(15)

r=0

A message bit is decoded as 1 when at least ⌈R/2⌉ replicas vote for 1. For even R, ties are resolved in favor of 1. We evaluate the extracted message m̂ against the original message m ∈ {0, 1}n based on Eq. (3). To RQ1: The target magnitudes 0 and α place the decision threshold at α/2, so both targets have a margin of α/2. 4. EXPERIMENTS 4.1. Experimental Setup WaveMark Setup. We generate 512 × 512 images using Stable Diffusion 2.1-base (SD2.1) [21] with 50 DDIM sampling steps and a guidance scale of 7.5. WaveMark embeds a fixed 64-bit message using a 256-bit key. We assign 12, 12, 4, and 3 replicas per bit to HL1 , LH1 , HL2 , and LH2 (i.e., R = 31), yielding 1,984 disjoint carriers for the 64-bit message. For decoding, we run 50 DDIM inversion steps with an empty prompt and a guidance scale of 1.0. Using Eq. (4), we set ϵ = 10−3 and use τ = 46/64 = 71.875%, corresponding to an FPR of 3.09 × 10−4 under H0 . Models and datasets. We use SD2.1 as the default backbone for image generation and for watermarking methods that operate during diffusion generation. Prompts are randomly sampled from the Stable Diffusion Prompts (SDP) dataset [22] and MS-COCO Captions dataset [23]. For each in-generation method, we generate 100 watermarked images at a resolution of 512 × 512 using SD2.1. All diffusion generation runs use 50 DDIM denoising steps. Watermarking Baselines. We compare our method with six baselines for watermarking AI-generated images, including Stable Signature (SSig) [7], SleeperMark [24], VINE [25], Gaussian Shading (GS) [4], PRC [5], and T2SMark [3]. Attack baselines. We evaluate WaveMark against five common image distortions: Gaussian noise, Gaussian blur, 50% random cropping, contrast adjustment, and JPEG compression. We also consider regeneration-based removal attacks, including DA [11], VA [17], CtrlRegen+ [13], and NFPA [16], as well as adversarial attacks, including UnMarker [12], Imprint [14], and NPA [26]. We additionally evaluate robustness against two recent SOTA removal attacks: MarkNull and MarkNull-A [15]. We follow the attack configurations reported in the original papers and apply each attack to 100 generated watermarked images per watermarking method. Evaluation Metrics. We evaluate watermark performance using BA. We assess image generation quality using CLIP-Score [27], CLIP-IQA [28], and FID [29].

Table 1. Watermark performance and image quality on SDP and MS-COCO Captions, with 100 images per method per dataset. SDP

Method

MS-COCO Captions

BA (%) ↑ CLIP-Score ↑ CLIP-IQA ↑

FID ↓

BA (%) ↑ CLIP-Score ↑ CLIP-IQA ↑

FID ↓

SSig[ICCV’23] SleeperMark[CVPR’25] VINE[ICLR’25] GS[CVPR’24] PRC[ICLR’25] T2SMark[NeurIPS’25]

99.85 99.92 99.84 100.0 100.0 100.0

27.689 28.229 27.066 27.701 28.047 27.946

0.8452 0.8796 0.9143 0.9064 0.9104 0.9033

155.680 169.536 153.068 151.392 156.512 151.837

99.69 99.50 99.82 100.0 100.0 100.0

26.021 26.381 25.760 25.799 26.034 25.832

0.8937 0.8421 0.9422 0.9479 0.9405 0.9392

153.196 161.515 151.344 141.264 147.439 148.548

WaveMark

100.0

27.648

0.9244

153.926

100.0

25.680

0.9476

151.412

Table 2. BA (%) of watermarking methods under various attacks. Common image distortions

Watermarking

Regeneration-based attacks

Adversarial attacks

Noise

Blur

Crop

Contrast JPEG

DA

VA

SSig SleeperMark VINE GS PRC T2SMark

95.08 98.92 99.30 99.59 70.64 99.53

84.33 99.88 99.64 100.0 82.18 100.0

99.16 95.91 52.42 99.72 66.94 99.96

98.04 99.70 98.08 99.99 80.35 99.97

85.13 99.83 99.82 99.97 78.83 99.92

48.50 99.46 90.04 99.68 69.38 99.90

62.79 95.75 95.16 98.76 66.51 98.14

46.63 88.04 71.06 93.35 59.42 94.62

48.50 82.79 50.88 51.16 50.13 49.83

92.18 99.52 97.54 99.83 91.46 98.17

45.83 83.23 71.70 28.16 46.45 52.18

47.25 90.17 80.26 49.27 49.89 63.92

49.33 41.63 61.36 36.49 47.41 51.82

45.63 41.38 57.16 74.74 54.48 51.05

WaveMark

98.84 100.0 99.75

99.81

99.94 98.25 96.72

79.47

54.18

98.65

84.72

92.47

88.66

88.06

4.2. Experimental Results Watermark performance and image quality. As shown in Table 1, WaveMark reaches 100.0% BA on both datasets. WaveMark has the highest CLIP-IQA on SDP and ranks second on MS-COCO Captions, which suggests that embedding the watermark has little effect on perceived image quality. Its CLIP-Score decreases from 27.648 on SDP to 25.680 on MS-COCO Captions. The baselines show a similar decrease, so this change appears to be associated with the dataset rather than with WaveMark alone. The corresponding FID values are 153.926 and 151.412. WaveMark does not have the best value for every metric, but it retains competitive image quality while achieving full BA. Figure 2 provides a visual comparison of images generated by different watermarking methods using SD2.1. The WaveMark samples preserve both semantic content and fine visual details, with no obvious watermark-induced artifacts, demonstrating promising image quality. (b) SSig

(c) SleeperMark

(d) VINE

(e) GS

(f) PRC

(g) T2SMark

SDP

MS-COCO Caption

(a) WaveMark

Fig. 2. Images generated by different watermarking methods using SD2.1 on two prompt datasets. Robustness Evaluation. Table 2 compares WaveMark with six baselines under 14 attacks. WaveMark achieves 98.84% to 100.0% BA under common distortions, including 99.75% under 50% random cropping with black padding and 99.81% under contrast adjustment. Under regeneration attacks, BA reaches 98.25% for DA and 96.72% for VA, but decreases to 79.47% for CtrlRegen+ and 54.18% for NFPA. Under the SOTA MarkNull and MarkNull-A attacks, Wave-

CtrlRegen+ NFPA UnMarker Imprint

NPA

MarkNull MarkNull-A

Mark achieves the highest BA of 88.66% and 88.06%, respectively, improving on the strongest baselines by 27.30% and 13.32%. NFPA treats the watermarked image as an initial video frame and predicts the next frame to remove the watermark. Although this suppresses the watermark, the resulting images differ substantially from the original inputs [15, 16].Except for NFPA, WaveMark’s BA remains above the 71.875% detection threshold under all evaluated attacks. These results demonstrate strong robustness to common distortions and adversarial removal attacks, providing a practical foundation for reliable watermark detection and user attribution. Cross-architecture Compatibility. To assess compatibility across diffusion architectures, we evaluate WaveMark on Stable Diffusion 3.5-Medium (SD3.5) [30], extending our experiments from the U-Net-based SD2.1 to the DiT architecture. WaveMark achieves 99.81% and 100.0% BA on SDP and MS-COCO Captions. The corresponding CLIP scores are 28.963 and 26.513, CLIP-IQA scores are 0.937 and 0.922, and FID values are 81.079 and 205.881. These results demonstrate reliable watermark recovery and detection on SD3.5, supporting WaveMark’s compatibility with both U-Net and DiT architectures.

5. CONCLUSION We have proposed WaveMark, a robust wavelet-domain watermarking method that embeds messages in the initial noise of LDMs. It distributes keyed message replicas across wavelet subbands and encodes each replica in a carrier’s projection magnitude to improve the robustness against advanced watermark removal attacks. On SD2.1, WaveMark achieves 100.0% BA without attacks and retains 88% BA under MarkNull and MarkNull-A, outperforming all baselines. Experiments on SD3.5 also support its applicability to a DiT architecture for watermark embedding. Future work will extend WaveMark toward publicly verifiable watermarking, enabling third-party verification without disclosing users’ secret keys.

6. REFERENCES [1] Xuandong Zhao, Sam Gunn, Miranda Christ, Jaiden Fairoze, Andrés Fábrega, Nicholas Carlini, Sanjam Garg, Sanghyun Hong, Milad Nasr, Florian Tramèr, Somesh Jha, Lei Li, YuXiang Wang, and Dawn Song, “Sok: Watermarking for aigenerated content,” in Proc. IEEE S&P, 2025, pp. 2621–2639. [2] Jie Cao, Qi Li, Zelin Zhang, Jianbing Ni, and Rongxing Lu, “Secure and robust watermarking for ai-generated images: A comprehensive survey,” arXiv preprint arXiv:2510.02384, 2025. [3] Jindong Yang, Han Fang, Weiming Zhang, Nenghai Yu, and Kejiang Chen, “T2smark: Balancing robustness and diversity in noise-as-watermark for diffusion models,” in Proc. NeurIPS, 2025, vol. 38, pp. 118642–118668. [4] Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu, “Gaussian shading: Provable performance-lossless image watermarking for diffusion models,” in Proc. CVPR, 2024, pp. 12162–12171. [5] Sam Gunn, Xuandong Zhao, and Dawn Song, “An undetectable watermark for generative image models,” in Proc. ICLR, 2025. [6] Sven Gowal, Rudy Bunel, Florian Stimberg, David Stutz, Guillermo Ortiz-Jimenez, Christina Kouridi, Mel Vecerik, Jamie Hayes, Sylvestre-Alvise Rebuffi, Paul Bernard, et al., “Synthid-image: Image watermarking at internet scale,” arXiv preprint arXiv:2510.09263, 2025. [7] Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon, “The stable signature: Rooting watermarks in latent diffusion models,” in Proc. ICCV, 2023, pp. 22409–22420. [8] Cheng Xiong, Chuan Qin, Guorui Feng, and Xinpeng Zhang, “Flexible and secure watermarking for latent diffusion model,” in Proc. MM. 2023, pp. 1668–1676, ACM. [9] Changhoon Kim, Kyle Min, Maitreya Patel, Sheng Cheng, and Yezhou Yang, “WOUAF: weight modulation for user attribution and fingerprinting in text-to-image diffusion models,” in Proc. CVPR, 2024, pp. 8974–8983. [10] Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein, “Tree-rings watermarks: Invisible fingerprints for diffusion images,” in Proc. NeurIPS, 2023. [11] Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li, “Invisible image watermarks are provably removable using generative AI,” in Proc. NeurIPS, 2024. [12] Andre Kassis and Urs Hengartner, “Unmarker: A universal attack on defensive image watermarking,” in Proc. IEEE S&P, 2025, pp. 2602–2620. [13] Yepeng Liu, Yiren Song, Hai Ci, Yu Zhang, Haofan Wang, Mike Zheng Shou, and Yuheng Bu, “Image watermarks are removable using controllable regeneration from clean noise,” in Proc. ICLR, 2025. [14] Andreas Müller, Denis Lukovnikov, Jonas Thietke, Asja Fischer, and Erwin Quiring, “Black-box forgery attacks on semantic watermarks for diffusion models,” in Proc. CVPR, 2025, pp. 20937–20946.

[15] Jie Cao, Qi Li, Zelin Zhang, Xiaodong Wu, Lingshuang Liu, Xiangman Li, and Jianbing Ni, “MarkNull: Model-agnostic watermark removal in AI-generated images via on-manifold latent manipulation,” in Proc. USENIX Security, 2026. [16] Huming Qiu, Zhaoxiang Wang, Mi Zhang, Xiaohan Zhang, Xiaoyu You, and Min Yang, “The future unmarked: Watermark removal in ai-generated images via next-frame prediction,” in Proc. NeurIPS, 2025. [17] Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, and Furong Huang, “WAVES: benchmarking the robustness of image watermarks,” in Proc. ICML, 2024. [18] Jiaming Song, Chenlin Meng, and Stefano Ermon, “Denoising diffusion implicit models,” in Proc. ICLR, 2021. [19] Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu, “Dpm-solver++: Fast solver for guided sampling of diffusion probabilistic models,” Mach. Intell. Res., vol. 22, no. 4, pp. 730–751, 2025. [20] Brian Chen and Gregory W Wornell, “Achievable performance of digital watermarking systems,” in Proceedings IEEE International Conference on Multimedia Computing and Systems. IEEE, 1999, vol. 1, pp. 13–18. [21] Stability AI, “Stable diffusion 2.1 base,” Hugging Face model repository, 2022. [22] Gustavosta, “Stable-diffusion-prompts,” Hugging Face Datasets repository, 2022, (accessed on Oct. 27, 2025). [23] Xinlei Chen, Hao Fang, Tsung-Yi Lin, Ramakrishna Vedantam, Saurabh Gupta, Piotr Dollár, and C Lawrence Zitnick, “Microsoft coco captions: Data collection and evaluation server,” arXiv preprint arXiv:1504.00325, 2015. [24] Zilan Wang, Junfeng Guo, Jiacheng Zhu, Yiming Li, Heng Huang, Muhao Chen, and Zhengzhong Tu, “Sleepermark: Towards robust watermark against fine-tuning text-to-image diffusion models,” in Proc. CVPR, 2025, pp. 8213–8224. [25] Shilin Lu, Zihan Zhou, Jiayou Lu, Yuanzhi Zhu, and Adams Wai-Kin Kong, “Robust watermarking using generative priors against image editing: From benchmarking to advances,” in Proc. ICLR, 2025. [26] Nir Goren, Oren Katzir, Abhinav Nakarmi, Eyal Ronen, Mahmood Sharif, and Or Patashnik, “Noiseprints: distortion-free watermarks for authorship in private diffusion models,” in Proc. ICML, 2026, vol. 2026, pp. 99698–99727. [27] Jack Hessel, Ari Holtzman, Maxwell Forbes, Ronan Le Bras, and Yejin Choi, “Clipscore: A reference-free evaluation metric for image captioning,” in Proc. EMNLP, 2021, pp. 7514–7528. [28] Jianyi Wang, Kelvin CK Chan, and Chen Change Loy, “Exploring clip for assessing the look and feel of images,” in Proc. AAAI, 2023, pp. 2555–2563. [29] Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter, “Gans trained by a two time-scale update rule converge to a local nash equilibrium,” in Proc. NeurIPS, 2017, pp. 6626–6637. [30] Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, et al., “Scaling rectified flow transformers for high-resolution image synthesis,” in Proc. ICML, 2024.

Related documents

• WaveMark: Robust Wavelet-Domain Image Watermarking for Diffusion Models#1297304
• Watermark Forensics for Generative Models: An Information-Theoretic Perspective#366189
• LiBRA: Detection-Aware Image Watermark Removal via Bidirectional Latent Optimization#1187844
• LiBRA: Detection-Aware Image Watermark Removal via Bidirectional Latent Optimization#1181561
• FARI: Robust One-Step Inversion for Watermarking in Diffusion Models#410939