Secure Seed-Based Multi-bit Watermarking for Diffusion Models from First Principles
arXiv:2605.06153v1 [cs.CR] 7 May 2026
Enoal Gesny Inria Rennes, France [email protected]
Eva Giboulot Inria Rennes, France
Abstract The rapid emergence of generative image models has led to the development of specialized watermarking techniques, particularly in-generation methods such as seed-based embedding. However, current evaluations in this area remain largely empirical, making them heavily reliant on the specific model architectures used for generation and inversion. This prevents any clear conclusion on the performance of any method, especially regarding security, for which a rigorous definition is lacking. Against this approach, we argue that the effectiveness of a watermarking scheme should be established purely through a thorough theoretical analysis. This is enabled by decoupling the model-dependent part from the actual decision mechanism of the watermarking system. Using this decoupling, we introduce a formal evaluation framework based on security, robustness, and fidelity. This allows precise comparisons between watermarking systems through a characteristic surface representing the trade-off between these three quantities, independent of any generative model. Based on this framework, we propose SSB , a novel watermarking method that generalizes previous seed-based methods by allowing to reach any security-robustness-fidelity regime on its characteristic surface. This work opens the door to the design of modern watermarking systems with theoretical guarantees that do not necessitate any costly empirical evaluations.
1
Introduction
Watermarking involves embedding an invisible signal within the content, which can be retrieved by a detector using a key. This signal is classified as either multi-bit, in which the aim is to recover a binary message, or zero-bit, in which case the detector only decides if the content is watermarked or not, with guarantees in terms of probability of false-alarm. As a specialized data-hiding approach, the goal of a watermarking system is to embed a signal robust to content alterations while preserving content quality with guarantees of security under a given threat model. Traditional (post-hoc) watermarking methods [16, 17, 6] embed the signal directly into the image, which limits their applicability to private APIs. To address the challenges posed by image generation, novel approaches propose to embed the watermark during the generation process. This can be performed during the diffusion [19], or through a fine-tuned VAE’s decoder [15]. A third approach, which we call seed-based, modifies the seed distribution to incorporate the watermark and subsequently inverts the diffusion process to retrieve it. Interestingly, this approach is also not amenable to open-source models since neither the diffusion model nor the VAE can be modified to enforce the use of a given seed-distribution. However, it possesses the unique property that no distortion is introduced in an already existing latent or image: only the seed distribution is distorted. The promise is thus to allow extreme robustness by finding a distribution that leads to Preprint.
images with similar quality despite being potentially far from the original Gaussian distribution of the seed. The approach was first introduced in the zero-bit setting by Tree-Rings [33], which demonstrated that a large distortion of the seed distribution does not necessarily lead to low-quality images. Indeed, Tree-Rings is empirically robust to every valuemetric image processing such as JPEG compression. Robustness to geometric operations is currently an open-problem due to the fact that the latent space depends on the size of the input image. Note that the original scheme contained numerous mistakes which were subsequently fixed in [11] and [19][Appendix I]. Gaussian-Shading [36] translated the idea to the multi-bit setting. It importantly introduced the idea of using a cryptographic primitive controlled by a secret key to generate the latent seed. This has two major benefits. First, it allows to hide the content of the embedded message. Secondly, the resulting scheme is distortion-free: the original seed distribution is preserved on average with respect to the key. As such, if each image generated by Gaussian-Shading was produced with different messages and/or keys, the image distribution should be indistinguishable from the non-watermarked model. All these properties: high image quality, high empirical robustness, and cryptographic security, can be enticing to the practitioner, but we argue that they are fundamentally flawed in their definitions. Quality and empirical robustness are fundamentally tied to the generative model; this precludes any strong conclusion regarding the performance of a given watermarking scheme. In other words, only propositions of the type "Watermarking system A is more robust/qualitative than Watermarking system B against transformation T for diffusion model M with VAE V and scheduler S" can be made. The practitioner would want to make propositions of the type "Watermarking system A is more robust/qualitative than Watermarking system B", whatever the model or operation used. In Section 2, we propose to forego the concept of quality in favor of the concept of fidelity. Similarly, we construct a refined definition of robustness independent of the generative model, based on traditional watermarking approaches. This results in a framework that permits such a rigorous ranking of watermarking systems purely on theoretical grounds. The question of watermarking security and cryptographic security is a lot more nuanced. It is highly dependent on the threat model agreed upon by practitioners. Nevertheless, we argue in Section 2 that they are very different notions, following the consensus that emerged for classical watermarking methods [13, 3]. One can indeed have both, yet cryptographic security alone does not prevent some powerful spoofing attacks from being performed on the watermarking system at basically no cost to the attacker. After this work meant to clarify the three main desirable properties for seed-based watermarking, we arrive at three main contributions. First, we propose a methodological framework for comparing seed-based watermarking algorithms, focusing on the trade-offs between security, capacity, and fidelity independently of the diffusion model used. Then, we design a new seed-based watermarking based on this framework that generalizes current multi-bit approaches, allowing to achieve a wide variety of security-fidelity-capacity tradeoff. Finally, we provide an empirical validation of the theoretical guarantees of the scheme.
2
Decoupling the decision from the diffusion
Before starting, it is important to consider what counts as an acceptable watermark system. This requires a clear delimitation of the problem we are trying to solve with watermarking. Consider the following illustrative scenario: Watermarking attribution scenario Alice makes accessible an API where users can request for images to be generated. In order to trace the use of her system, she asks Bob, a third-party, to provide her with a secret key k and a seed-based watermarking system W. From the point of view of Bob, the secret key k is now uniquely linked to Alice. She then associates to each user a unique ID mi . Each request generates an image, using W, that contains a watermark. If Bob is presented with the key k and a watermarked image generated for user i, he should decode the correct message mi . The most important constraint of this scenario is that Alice cannot change her secret key but can use as many messages as she wants. Contrary to what is often assumed in the current watermarking literature, we argue that it is not trivial to work with many keys when using a multi-bit watermarking 2
system. Indeed, if Alice uses multiple keys, attribution becomes difficult if not impossible: if she wants to extract the message from a given image, how does she determine which key to trust? Recall that Alice does not know from which user the image came. Furthermore, one cannot solve the problem by associating a unique key to each user and choosing the correct one for decoding; this requires an oracle. If such an oracle exists, then watermarking is not necessary since attribution is solved simply by using this oracle. The rest of the section is dedicated to developing a rigorous evaluation framework for watermarking systems, aiming to address the attribution scenario. For clarity and space considerations, we settle on a mostly informal and intuitive tone in the paper itself, but always link to formal definitions in Appendix B for important notions. We also advise the reader to peek at Appendix A for a review of notations used in the paper. 2.1
Watermarking systems
A watermarking system W – Def. B.1 – can be decomposed into four main elements: a set of secret keys K, a projection function f , a family of embedding mechanisms (ek )k∈K , and a decision mechanism d. The projection function f : RD → RL (L ≤ D) transforms a piece of content into a representation more amenable to embedding and detection – the so-called watermark space. It should be robust to a family of usual content alterations. Embedding mechanisms ek – Def. B.1 – are functions parameterized by the secret key. Their goal is to push a point in watermark space deep inside a specific region called the decoding region. The watermarked distribution obtained is denoted as Q(k,m) . The decision mechanism d – Def. B.1 – maps points of the watermark space to either a score (zero-bit watermarking) or a message (multi-bit watermarking). Our interest in this paper lies solely in multi-bit schemes. We will see in Section 2.2 that it is useful to separate the redundancy mechanism – Def.B.3 – (i.e, the error-correcting code) from the decision mechanism. For the rest of the paper, we thus make the distinction between a message m of size M and its corresponding representative codeword c of size M ′ > M . When using a redundancy mechanism, the watermarking system becomes an error-corrected watermarking system – Def. B.4 – which notably changes the watermarking distribution from Q(k,m) to Q(k,c) . One important property of a watermarking system is that it should be difficult to randomly find a piece of content that follows the desired watermarked distribution. We formalize this with the concept of cover distribution, denoted as P – Def. B.5. Informally, we expect message bits decoded from images sampled from a cover distribution to be independent and not biased in favor of a particular message. Such property is usually enforced by whitening a decoder [15, 19] or by designing so-called sound detectors from the ground-up [14]. Finally, seed-based watermarking enforces a specific structure on the cover distribution that will form the basis of the analysis in Section 3.2: Definition 1 (Seed-based system – Def.B.6). A watermarking system W equipped with cover distribution P is said to be seed-based if the projection of non-watermarked content in watermark space is distributed as a standard Gaussian. That is we have that: f (X) ∼ N (0, IL ), X ∼ P. We now define the three main quantities of interest for a watermarking system: capacity, fidelity, and watermarking security. We contrast these properties to the more common trio of robustness, quality, and cryptographic security. For clarity, we split each subsection into two parts. The first discusses the current approach in measuring a given quantity, and why we believe it to be unsatisfying. The second formalizes our approach in an abstract and general fashion. 2.2
Robustness versus Capacity
All recent works on seed-based studies empirically assess robustness by evaluating the chosen detection statistics under a set of image transformations [15, 16, 36, 7, 19]. We claim that this empirical approach for evaluating robustness suffers from a major problem: Problem No definite claim on the ranking of different watermarking designs can be made since the performance depend on every choice of the inverse diffusion pipeline, notably: the choice of diffusion model, the scheduler/solver, the number of inversion steps, the choice of VAE, the presence or absence of prompts at inversion, and in the former case the value of the guidance scale. The inverse 3
diffusion can be improved, for example by the choice of a better solver. However, we claim this can hardly be called an improvement over the watermarking system itself, only that it benefits from a "better" estimation of the seed. Traditional watermarking sidestepped these issues by evaluating the robustness of a given scheme theoretically. The main idea was to assume that any alteration in pixel space translates to a white Gaussian noise with a given power in watermark space [9, 24, 17]. Thanks to the properties of the latent space in seed-based watermarking, we can expect this model of robustness to be a good approximation of reality – something we empirically validate in Section 4. Consequently, it would be natural to model the decision mechanism as an additive (potentially not) white Gaussian noise channel AWGNσ . However, since bit-accuracy is so prevalent in current watermarking evaluations, it is fruitful instead to model the decision mechanism as M ′ independent binary symmetric channels with flip probability p – noted BSCp . We discuss this choice in Appendix C.1: the main takeaway is that Shannon’s capacity is a good summary of the overall watermarking system performance, which depends on both the robustness σ of the projection f and the so-called channel characteristic pk (σ) of the decision mechanism d. Indeed, notice that the flip probability p depends on two parts of the system: the projection f , and the watermarked distribution Qk . In practice, an alteration in pixel space introduces some noise in watermark space. This noise will, in turn, impact p, with the impact depending on Qk . This is where we perform the decoupling between f and d. We measure the robustness of f against a transform t by the variance σ 2 of the noise tintroduces in watermark space – Def. B.7. We then define the decision channel characteristic pk (σ) of d as the mapping between σ and p – see Def. B.8. Informally, the channel characteristic is the bit-error rate of the system, before error-correction, under a white Gaussian perturbation with variance σ 2 . The combination of both quantities leads to the Shannon capacity, which perfectly summarizes how much noise a watermarking system can resist for a given codeword size. Proposition 1 (Capacity of a watermarking system). Let t : RD → RD be a function. A watermarking system W with projection f that is σ-robust to t and with channel characteristic pk has a Shannon capacity Cσ = 1 − h2 (pk (σ)), where h2 is the binary entropy function. This means that the system cannot communicate the watermark reliably unless the message m is coded with a codeword c of size M ′ ≥ ⌈ CMσ ⌉. Except when specifically stated, we assume to work at Shannon’s capacity in order to be agnostic to the choice of redundancy mechanism. As such, the decision mechanism is only determined by its channel characteristic, which maps a given noise power σ 2 to a given flip probability p. In practice, one has to choose an off-the-shelf code depending on the desired properties. Turbo codes [4] and Polar codes [1] allow the use of rates close to Shannon’s capacity. Pseudo-random codes (PRC) [10] provide cryptographic security. Gaussian-Shading use of repetition code [36][Section 3.2], though highly suboptimal in every sense, is simple to implement and analyse. 2.3
Quality versus Fidelity
Quality is straightforward to define in the case of post-hoc watermarking. It suffices to compare the host image to the watermarked one. In particular, the PSNR is equivalent to the power of the watermark signal in this case. This is not possible in our case. Problem 1 In-generation watermarking is peculiar because it lacks any original host image. Instead, the standard approach in the literature is to use empirical distance between the distribution of images generated by the watermarked model and a given distribution of un-watermarked images (generated or not) [19, 33, 20]. This is usually performed using the FID [22], which is notoriously unable to describe some important sampling failure modes [28, 29]. Notably, the diversity of content generation is difficult to assess using this metric. As an example, for a given key and message, the support of the seed-distribution of Gaussian-Shading is cut in half, leading to an observed lack of variety in generated content [20][Figure 13] but no observed impact on the FID. The choice of baseline distribution is also not trivial if one is concerned with reproducibility and comparability: papers report baseline FID that differ substantially between one another [15, 33, 36, 19, 20, 23]. Another approach is to use "semantic" distances such as the CLIP score [21], but this is also not satisfactory: 4
a watermarked model that preserves semantics but significantly degrades the aesthetic content is not desirable. This overall difficulty in empirical evaluation also demonstrates that there is a lack of clarity in what constitutes an acceptable degradation of the generative model. We argue that the role of the watermark designer is not to guarantee a certain level of generation quality; that is the role of the model provider. The role of the watermark designer is rather to guarantee that the watermarked model preserves the properties of the original one. In the case of seed-based watermarking, the seed distribution is what impacts the generation. As such, the watermark designer wants to preserve the original distribution as much as possible. The quantification of the deviation from this original distribution is what we call fidelity. Problem 2 Under our scenario, the secret key is fixed, and a user is linked to a unique message. Thus, a distortion-free scheme is not sufficient for our purpose: it only guarantees that, on average over the messages, the properties of the non-watermarked model are preserved. A case in point is again Gaussian-Shading: each user is attributed only half of the available sampling space for seeds. On average over the users, all of the sampling space is used. Yet, an unlucky user might only be able to access seeds that lead to "low-quality" images. This is not desirable and points to the need to preserve the original distribution as much as possible for all keys and messages. Starting from the fundamental property of seed-based systems in Def. B.6, it is natural to measure fidelity as an f-divergence between the standard multivariate Gaussian distribution and a watermarked distribution Q(k,c) . For this paper, we settle on the Kullback-Leibler (KL) divergence, though it will require our analysis to use some asymptotic arguments in the next section. Definition 2 (Fidelity of Seed-based watermarking – Def.B.9). A watermarked distribution Q(k,c) of a seed-based watermarking system is said to be ζ-faithful iff DKL (N (0, IL )||Q(k,c) ) ≤ ζ. We call ζ the relative fidelity loss with respect to the Gaussian distribution. 2.4
Cryptographic versus Watermarking Security
Problem: Watermarking is not cryptography The question of security for modern watermarking is slowly emerging as trivial vulnerabilities are found in state-of-the-art post-hoc schemes due to the lack of secret keys [2, 30]. Seed-based watermark systems have tackled this question under the cryptographic angle, both in Gaussian-Shading and the more recent applications of PRC [10, 20]. The idea conveyed by these works is that a watermarking system is secure if an attacker cannot infer anything of the embedded message from the watermarked seed. The conflation between this type of cryptographic security and watermarking proper is not new and dates back to the early 2000s. The problem was eloquently settled by Cox et al. in [13], which demonstrates that cryptography and security solve different problems. Maybe the key difference between watermarking and cryptography outlined in this work is the following “the secret carrier does not need to be exactly disclosed in order to break the watermarking system” [13][Section 4.1]”. We point out that both Gaussian-Shading and PRC do not even hide the encrypted message within a secret carrier! It is readily available to any attacker by simply taking the sign of a watermarked seed. Once again, it is useful to illustrate this problem with a scenario that will serve as our threat model: Threat model: Spoofing attack Eve is a user of Alice’s API. She is a friend of Kerckhoffs, an employee of Alice who disclosed to her the full watermarking system, W except for the secret key k. She thus knows that each user is given a unique message. She would like to impersonate Camille, another user from whom she has stolen No generated images. Since she was disclosed the watermarking system, she can retrieve the watermarked seed from each image. Furthermore, she knows that all Camille’s images contain their unique ID mCamille . Note that in order to make her system more secure, Alice prevents a user from using the same seed twice. Hence, Eve cannot simply reuse Camille’s seed to generate new images. Under this threat model, both Gaussian-Shading and PRC are highly insecure. Even though Alice does not know the exact value of mCamille , she has access to a codeword cCamille linked to Camille, which is sufficient for her: encryption does not bring any security in this situation. Indeed, since neither scheme makes the carrier secret, she can simply retrieve the encrypted message, sample a 5
Decision d
Image Generation Sampled seed
Generated Image
Projection f
Projected seed
Lattice Diffusion Process
Inverse Diffusion
Λ
c ∈ {0, 1}M
′
U c ∈ {0, 1}M U∈K
′
Figure 1: This is the diagram of SSB proposed. The unitary matrix U is used as the key. The projection f is the inverse diffusion from the image in pixel space to an approximation of the seed in the latent space. The decision mechanism d is the use of the lattice function Λ∆ . new seed from it, and generate a new image with it. This underlines the fundamental difference of watermarking security: the codeword carrier needs to be secret. We evaluate the security of a watermarking system by the availability of an estimator ψ to retrieve the secret key k. We convey this approach through the notion of security ratio. Informally, it measures the number of watermarking samples necessary for Eve to mount an attack that is better than a naive brute-force: Definition 3 (Security ratio – Def.B.10). A M -bit error-corrected watermarking system W with codeword size M ′ is η-secure against an estimator ψ if it requires at least No = ηL watermarked observations to estimate a fixed key k ∈ K better than randomly guessing. That is, for any codeword ′ c ∈ {0, 1}M : 1 ηL = min{N | P[d eψk (N ) (c), k = c] > M ′ , N ∈ N+ } 2
(1)
where ψk (N ) is an estimation of the key k based on N i.i.d. samples Z ∼ Q(k,c) . We call η the security ratio of W against ψ. If η = +∞, we say that W is perfectly secure against ψ. Since both Gaussian-Shading and PRC do not use a secret key to conceal their codewords, it only necessitates a single sample to mount an attack, hence η = 1/L for both of them.
3
A general lattice-based construction
We propose Secure Seed-Based (SSB), a multi-bit watermarking scheme heavily inspired by older schemes from the classic watermarking literature based on Voronoï modulation [9, 8] (also see Chapter 9 in [37]). Compared to these works, our approach is substantially simplified: we use two nested one-dimensional lattices in order to securely transmit a binary codeword. Despite the simplicity of the approach, this decision mechanism can operate under a wide range of capacity-fidelity-security trade-off, generalizing and largely outperforming current approaches. A surprising result is that perfectly secure transmission in the sense of Def.B.10 is often possible even under high noise variance σ 2 – see Appendix E. Our focus here is solely on the embedding function and decision mechanism. We do not try to optimize the estimation of the original seed by improving the projection function (i.e. the inverse diffusion process). Similarly, recall that we are agnostic to the choice of error-correcting code; the only quantity of interest is the decision channel characteristic p(σ) from Def. B.8. Figure 1 illustrates the functioning of the method. 3.1
Embedding and decoding ′
Let c be the binary codeword to hide. We define the key set Ku as the set of matrices in ML×M which have their columns summing to one – in particular if M ′ = L, the matrix is unitary. Let ′ ′ U ∈ Ku . Finally, let the alternating lattice function Λ∆ : RM → {0, 1}M be defined as: x
(−1)⌊ ∆ ⌋ + 1 , (2) 2 with ∆ the size of a cell. We call Λ∆ the coarse lattice. Note that when ∆ → +∞, the lattice function tends to the sign function: this is the decision mechanism of Gaussian-Shading. Λ∆ (x) =
6
′
Our goal is to sample a vector zu ∈ RM such that the lattice outputs the correct codeword: Λ∆ (zu ) = c. Once this is done, we have to project this vector into the original latent space RL . In order to improve the system’s capacity, we use a second, nested, lattice function Λδ defined in the same way as in Eq. (2) but with δ ≤ ∆. We call any such Λδ a fine lattice. An illustration of these embedding functions is proposed in Figure 2. Algorithm 1 details the sampling of zu . 1: procedure S AMPLE WM(∆, δ, c) 2: (ak )k∈Z ← 2k∆ ; (bk )k∈Z ← ak + ∆ 3: (αk )k∈Z ← ak + ∆−δ 2 ; (βk )k∈Z ← αk +δ 4: (pk )k∈Z ← Φ(ak ) − Φ(bk ) 5: for i ∈ M ′ do 6: k ∼ Categorical((pk )k∈Z ) 7: (zu )i ← sign(ci )TruncN[αk ,βk ] (0, 1) 8: end for 9: return zu 10: end procedure
Algorithm 1: Seed sampling algorithm for SSB. In practice, we truncate k between −10 and 10 for numerical evaluations.
Figure 2: Diagram of the nested lattices Λ∆ and Λδ . The coarse lattice cells are separated by full lines wheres fine cells are colored with dotted lines.
Now we still need to transform zu into a valid seed for the diffusion process. Any seed z ∈ RL can be decomposed as z = (IL − UU⊤ )z + UU⊤ z. In order to obtain a valid seed z from zu , one can thus sample z′ as a realization of a random variable Z ′ ∼ N (0, IL ) and compute z as: z = (IL − UU⊤ )z′ + Uzu .
(3)
For decoding, let x ∈ RD be an image watermarked with the codeword c. We compute an approximation of the original latent ẑ = f (x). The codeword is then decoded simply by applying the coarse lattice function on U⊤ ẑ giving Λ∆ (U⊤ ẑ) = ĉ. By construction, if the projection does not introduce any noise, U⊤ ẑ = U⊤ z = zu and consequently we retrieve the correct codeword: c = ĉ. 3.2
Theoretical Analysis
A direct consequence of Alg. 1 is that each watermarked element (zu )i is distributed as an infinite mixture of truncated Gaussian distributions. Using the notation in Alg.1 (or Appendix A), and writing the probability P to sample in the k-th lattice cell as Pk = 2(Φ(bk ) − Φ(ak )), we have that: (zu )i = sign(ci ) k∈Z Pk Zk with Zk ∼ TruncN[αk ,βk ] (0, 1). Since all watermarked elements are independent and follow the same distribution up to a sign, we note the unsigned expectation of 2 (zu )i as µ(∆,δ) and its variance as σ(∆,δ) – see Proposition D.1.1 for an exact formula of these two moments. Capacity The flip probability of an SSB decision mechanism is given by the probability that an element (zu )i corrupted by some Gaussian noise with variance σ 2 leaves the set of "correct" coarse lattice cells. Since the distribution of (zu )i is known, the channel characteristic p(∆,δ) (σ) of SSB is immediately given by Proposition 2. We plot the resulting capacity Cσ (∆, δ) computed numerically using Proposition 1 in Figure 3. Proposition 2 (SSB channel characteristic). Let (∆, δ) define a SSB system. Then the probability that a codeword bit is flipped due to a transform against which f is σ-robust is: h i R βj b −p − Φ akσ−p dp X X αj ϕ(p) Φ kσ p(∆,δ) (σ) = 1 − 2 Pj (4) Φ(βj ) − Φ(αj ) j=Z
k=Z
Fidelity Recall that under our watermarking scenario we must assume both the codeword c and the secret rotation U to be fixed. The support of the watermarked distributions induced by any lattice embedding is consequently on a strict subset of RL . The KL-divergence thus diverges with respect to the Gaussian distribution. However, U is applied on independent random variables with 7
Figure 3: Watermarking characteristic of (∆, δ)-SSB , showing the capacity, fidelity and security as a function of the lattice parameters as well as of the codeword size relative to the latent size α = M ′ /L
Figure 4: Empirical validation of the model defined in Section 2 for current seed-based approaches – Gaussian-Shading and PRC – as well as our method SSB . Transparent boxes correspond to theoretical values, opaque to empirical ones. We display 95% asymptotic confidence intervals. finite mean and variance, leading to a "Gaussianization" of the distribution of the watermarked seed. Consequently, we propose to compute the fidelity on the asymptotic distribution of the watermarked seed obtained by application of the Lyapunov central-limit theorem. Proposition 3 (SSB Asymptotic relative fidelity). Any (∆, size M ′ h δ)-SSB system with codeword i L→∞
is M ′ ζ(∆, δ)-faithful with ζ(∆, δ) −−−−→ 12 such that Lyapunov condition holds.
−2 2 1 + µ2(∆,δ) σ(∆,δ) + log σ(∆,δ) − 1 if U is chosen
Security: Principal Component Analysis (PCA) Attack In our watermarking scenario, an adversary, Eve, aims to estimate the secret key U from No watermarked observations. The eigenvalues of the covariance matrix of cover latents are the identity. However, the SSB embedding mechanism modifies these eigenvalues. As such, Eve’s best strategy relies on identifying deviation from the expected distribution of the eigenvalues of the empirical covariance estimated with the watermarked samples. Her best estimator is limited by the behavior of the Marchenko-Pastur distribution of the eigenvalues of empirical covariance matrices [5, 32]. We refer to Appendix C.2 as well as [18] for a primer on this type of attack. From Def. B.10, we consider security broken as soon as a single component of U is revealed by the estimator. The number of samples necessary to do so is given in Proposition 4. ′
Proposition 4 (SSB Watermarking security). Let α = ML . Any (∆, δ)-SSB is η-secure against a √ 2 1− ασ∆,δ PCA estimator where η = . 1−σ∆,δ
4
Experimental validation
4.1
Robustness of the inverse diffusion
We have defined robustness in Def.B.7 as the mapping between a certain image processing operation and an equivalent noise variance σ 2 introduced in watermarked space. For seed-based systems, robustness depends on two main empirical components: the diffusion model used for inversion and the choice of input distribution F. For the latter, one should, in all rigor, use watermarked images as input distributions in order to match the hypotheses of Proposition 1. However, for most image processing operations of interest, choosing a cover distribution – i.e., non-watermarked images – 8
LDM/Steps
Image size D
Latent size L
Identity
Brightness 0.2
Contrast 2.0
JPEG QF80
JPEG QF50
Center Crop 50%
Sana/ 25 Z-image / 9 Qwen / 50
5122 10242 5122
8192 262144 65536
0.21 0.35 0.34
0.29 0.45 0.44
0.46 0.66 0.78
0.31 0.9 0.78
0.42 1.08 1.09
1.94 1.51 2.09
Table 1: Equivalent white Gaussian noise variance σ 2 introduced in latent space for different common image operations – see Def. B.7. The Identity transforms corresponds to the noise introduced by the inverse diffusion process itself (f in Def.B.2). All diffusion models are used with the standard configuration provided one their Huggingface page – see Appendix H.
should be an extremely good proxy and allows one to provide an evaluation agnostic to the choice of watermarking system. We show in Section 4.2 that our assumption is indeed empirically valid. We measure the robustness of current popular flow-matching diffusion models against common image processing operations in Table 1. We chose Sana [35], Z-Image Turbo [31], and Qwen [34] due to their high popularity on Huggingface at the time of writing, as well as their difference in architecture. Sana’s VAE provides very high-compression rates, Z-Image Turbo is a distilled model, and Qwen is a very large model necessitating many (50) diffusion steps compared to the two other models1 . Our robustness evaluation protocol is as follow. We generated N = 100 images (x)N from a collection of N seeds (z)N using a given model and prompts from Huggingface:Gustavosta/ Stable-Diffusion-Prompts. The projection f is then defined as the standard inverse flow matching procedure using the Euler solver, for the same number of diffusion steps as during generation. We then estimate the variance of the introduced noise as the empirical variance of the residuals f (x) − x averaged over latent channels. 4.2
Comparing empirical and theoretical performances
We now validate our theoretical results to the empirical performance of SSB , Gaussian-Shading, and PRC. We choose to test two regimes for SSB (∆, δ) = (+∞, +∞) and (1.6, 0). The first regime uses a decision mechanism identical to Gaussian-Shading’s – the sign function. The second corresponds to the perfect security regime of SSB (η = +∞) – see Appendix E. For each watermarking system, we generate 500 images with the same prompts as in the previous sections using the Sana diffusion model. We first compute the empirical bit-accuracy of the codeword, which corresponds to the channel characteristic p(σ) in Def.B.8. From it we compute the optimal rate Rσ ≤ Cσ – see Def.1 – for which we are guaranteed to decode the correct message with negligible probability of decoding error Pe . For SSB , we set the rate to Shannon’s capacity at the empirical p(σ). Gaussian-Shading uses a repetition code; we thus compute the exact best rate that leads to a probability of decoding error Pe ≤ 10−6 for a given p(σ). Finally, PRC uses a belief-propagation code, BP+OSD [27], which is not compatible with our BSCp model since it uses soft-decisions. As such, we directly report the best theoretical and empirical rate for PRC. Since computing the best empirical rate would be far too costly for Pe ≤ 10−6 , we report it for Pe ≤ 10−2 , giving it a slight advantage. Fidelity and security are computed in turn using these rates. We report all results in Figure 4. Note that none of the current seed-based systems can resist cropping at 50%.
5
Conclusion
Modern watermarking methods lack a shared language. Methods are proposed and evaluated on different axes, and compared empirically in ways that conflate distinct design choices – the inverse diffusion model, the decision mechanism, and the error-correcting codes. This conflation makes it impossible to know whether a method is genuinely better, or simply makes a different trade-off. This work introduced a framework that allows fair theoretical comparison. By decoupling these components and anchoring the analysis in capacity, fidelity, and watermarking security, we bring multi-bit seed-based watermarking to align with classic watermarking methods. We also introduced a concrete implementation of this framework, SSB , a watermarking system that achieves a wide range of regimes along these three axes. Because each component is decoupled, each can be improved independently, and future work can do so without redesigning the whole system. We hope this work shifts the focus away from ad-hoc optimizations based on empirical evaluations, and towards design 1We deliberately chose not to use Stable-Diffusion 2 due to replicability concerns, as it was removed from Huggingface
9
with strong theoretical guarantees. Several directions follow naturally from this work. First, it is clear that the robustness of the projection function can be improved, for example by a better model of variance on each latent channel. Second, our analysis assumes a BSCp : understanding the gap with an AWGNσ remains to be studied. Finally, extending this framework to 0-bit seed-based watermarking is a natural (but not trivial!) next step.
References [1] Erdal Arikan. Channel polarization: A method for constructing capacity-achieving codes for symmetric binary-input memoryless channels. IEEE Transactions on Information Theory, 55(7):3051–3073, July 2009. arXiv:0807.3917 [cs]. [2] Patrick Bas and Jan Butora. The AI Waterfall : A Case Study in Integrating Machine Learning and Security. In GRETSI, Strasbourg, France, August 2025. [3] Patrick Bas and Teddy Furon. A new measure of watermarking security: The effective key length. IEEE Transactions on Information Forensics and Security, 8(8):1306–1317, 2013. [4] C. Berrou, A. Glavieux, and P. Thitimajshima. Near Shannon limit error-correcting coding and decoding: Turbo-codes. 1. In Proceedings of ICC ’93 - IEEE International Conference on Communications, volume 2, pages 1064–1070 vol.2, May 1993. [5] Pascal Bianchi, Merouane Debbah, Mylène Maïda, and Jamal Najim. Performance of Statistical Tests for Single Source Detection using Random Matrix Theory. IEEE Transactions on Information Theory, 57(4):2400–2419, April 2011. [6] Tu Bui, Shruti Agarwal, and John Collomosse. TrustMark: Universal Watermarking for Arbitrary Resolution Images, November 2023. arXiv:2311.18297 [cs]. [7] Tu Bui, Shruti Agarwal, and John Collomosse. TrustMark: Robust Watermarking and Watermark Removal for Arbitrary Resolution Images. pages 18629–18639, 2025. [8] Marc Chaumont and Dalila Goudia. TCQ practical evaluation in the hyper-cube watermarking framework. In 2011 IEEE International Conference on Multimedia and Expo, pages 1–6, July 2011. ISSN: 1945-788X. [9] B. Chen and G.W. Wornell. Quantization index modulation: a class of provably good methods for digital watermarking and information embedding. In 2000 IEEE International Symposium on Information Theory (Cat. No.00CH37060), pages 46–, June 2000. [10] Miranda Christ and Sam Gunn. Pseudorandom Error-Correcting Codes, June 2024. arXiv:2402.09370 [cs]. [11] Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. RingID: Rethinking Tree-Ring Watermarking for Enhanced Multi-Key Identification, July 2024. arXiv:2404.14055 [cs]. [12] Daniel J. Costello and G. David Forney. Channel coding: The road to channel capacity. Proceedings of the IEEE, 95(6):1150–1177, June 2007. [13] Ingemar J. Cox, Gwenaël Doërr, and Teddy Furon. Watermarking is not cryptography. In Proceedings of the 5th international conference on Digital Watermarking, IWDW’06, pages 1–15, Berlin, Heidelberg, November 2006. Springer-Verlag. [14] Pierre Fernandez, Antoine Chaffin, Karim Tit, Vivien Chappelier, and Teddy Furon. Three Bricks to Consolidate Watermarks for Large Language Models. In 2023 IEEE International Workshop on Information Forensics and Security (WIFS), pages 1–6, December 2023. ISSN: 2157-4774. [15] Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The Stable Signature: Rooting Watermarks in Latent Diffusion Models. pages 22466–22477, 2023. [16] Pierre Fernandez, Hady Elsahar, I. Zeki Yalniz, and Alexandre Mourachko. Video Seal: Open and Efficient Video Watermarking, December 2024. arXiv:2412.09492 [cs]. [17] Teddy Furon and Patrick Bas. Broken Arrows. EURASIP Journal on Information Security, 2008:ID 597040, October 2008. [18] Teddy Furon, Hervé Jégou, Laurent Amsaleg, and Benjamin Mathon. Fast and secure similarity search in high dimensional space. In 2013 IEEE International Workshop on Information Forensics and Security (WIFS), pages 73–78, November 2013. ISSN: 2157-4774.
10
[19] Enoal Gesny, Eva Giboulot, Teddy Furon, and Vivien Chappelier. Guidance watermarking for diffusion models. In The Fourteenth International Conference on Learning Representations, 2026. [20] Sam Gunn, Xuandong Zhao, and Dawn Song. An Undetectable Watermark for Generative Image Models, April 2025. arXiv:2410.07369 [cs]. [21] Jack Hessel, Ari Holtzman, Maxwell Forbes, Ronan Le Bras, and Yejin Choi. CLIPScore: A Reference-free Evaluation Metric for Image Captioning, March 2022. arXiv:2104.08718 [cs]. [22] Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. GANs trained by a two time-scale update rule converge to a local nash equilibrium. In Proceedings of the 31st International Conference on Neural Information Processing Systems, NIPS’17, pages 6629–6640, Red Hook, NY, USA, December 2017. Curran Associates Inc. [23] Kecen Li, Zhicong Huang, Xinwen Hou, and Cheng Hong. GaussMarker: Robust Dual-Domain Watermark for Diffusion Models. In Proceedings of the 42nd International Conference on Machine Learning, pages 34688–34701. PMLR, October 2025. [24] Stéphane Pateux and Gaëtan Le Guelvouit. Practical watermarking scheme based on wide spread spectrum and game theory. Signal Processing: Image Communication, 18(4):283–296, April 2003. [25] Yury Polyanskiy, H. Vincent Poor, and Sergio Verdu. Channel Coding Rate in the Finite Blocklength Regime. IEEE Transactions on Information Theory, 56(5):2307–2359, May 2010. [26] Yury Polyanskiy and Yihong Wu. Information theory: from coding to learning. Cambridge University Press, Cambridge, United Kingdom ; New York, NY, 2025. [27] Joschka Roffe, David R. White, Simon Burton, and Earl T. Campbell. Decoding Across the Quantum LDPC Code Landscape. Physical Review Research, 2(4):043423, December 2020. arXiv:2005.07016 [quant-ph]. [28] Mehdi S. M. Sajjadi, Olivier Bachem, Mario Lucic, Olivier Bousquet, and Sylvain Gelly. Assessing generative models via precision and recall. In Proceedings of the 32nd International Conference on Neural Information Processing Systems, NIPS’18, pages 5234–5243, Red Hook, NY, USA, December 2018. Curran Associates Inc. [29] Loic Simon, Ryan Webster, and Julien Rabin. Revisiting precision recall definition for generative modeling. In Proceedings of the 36th International Conference on Machine Learning, pages 5799–5808. PMLR, May 2019. [30] Hussein Tarhini, Aurélien Noirault, Jan Butora, and Patrick Bas. Neural Watermarking: Lack of a Secret Key is still Lack of Security. March 2026. [31] Image Team, Huanqia Cai, Sihan Cao, Ruoyi Du, Peng Gao, Steven Hoi, Zhaohui Hou, Shijie Huang, Dengyang Jiang, Xin Jin, Liangchen Li, Zhen Li, Zhong-Yu Li, David Liu, Dongyang Liu, Junhan Shi, Qilong Wu, Feng Yu, Chi Zhang, Shifeng Zhang, and Shilin Zhou. Z-Image: An Efficient Image Generation Foundation Model with Single-Stream Diffusion Transformer, November 2025. [32] Pascal Vallet, Philippe Loubaton, and Xavier Mestre. Improved subspace estimation for multivariate observations of high dimension: the deterministic signals case. IEEE Transactions on Information Theory, 58(2):1043–1068, February 2012. arXiv:1002.3234 [cs]. [33] Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings watermarks: Invisible fingerprints for diffusion images. In Thirty-seventh Conference on Neural Information Processing Systems, 2023. [34] Chenfei Wu, Jiahao Li, Jingren Zhou, Junyang Lin, Kaiyuan Gao, Kun Yan, Sheng-ming Yin, Shuai Bai, Xiao Xu, Yilei Chen, Yuxiang Chen, Zecheng Tang, Zekai Zhang, Zhengyi Wang, An Yang, Bowen Yu, Chen Cheng, Dayiheng Liu, Deqing Li, Hang Zhang, Hao Meng, Hu Wei, Jingyuan Ni, Kai Chen, Kuan Cao, Liang Peng, Lin Qu, Minggang Wu, Peng Wang, Shuting Yu, Tingkun Wen, Wensen Feng, Xiaoxiao Xu, Yi Wang, Yichang Zhang, Yongqiang Zhu, Yujia Wu, Yuxuan Cai, and Zenan Liu. Qwen-Image Technical Report, August 2025. arXiv:2508.02324 [cs]. [35] Enze Xie, Junsong Chen, Junyu Chen, Han Cai, Haotian Tang, Yujun Lin, Zhekai Zhang, Muyang Li, Ligeng Zhu, Yao Lu, and Song Han. SANA: Efficient High-Resolution Image Synthesis with Linear Diffusion Transformers, October 2024.
11
[36] Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shading: Provable performance-lossless image watermarking for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12162–12171, 2024. [37] Ram Zamir. Lattice Coding for Signals and Networks: A Structured Coding Approach to Quantization, Modulation and Multiuser Information Theory. Cambridge University Press, Cambridge, 2014.
A
Notation
Spaces • Pixel space: in RD with observations denoted x. • Latent space: in RL with observations denoted z. ′
• Watermark space: in RM with observations denoted zu . Distributions We use the standard notation for the standard Gaussian p.d.f ϕ and its c.d.f Φ. We denote the Truncated Gaussian with location µ and scale parameter σ and boundaries (a, b) as TruncN[a,b] µ, σ 2 . Other distributions are usually referred to with calligraphic letters (N ). Secure Seed Based watermarking system We refer to a (∆, δ)-SSB system as an error-corrected watermarking system (Def.B.4), where: • The set of secret keys is given by the set of L × M ′ matrices with columns summing to 1. An element of this set is denoted as U. • The projection function f is any function from RD to RL . • The embedding functions are given by Alg. 1 followed by Eq. (3). • The decision mechanism is simply Λ∆ as defined in Eq 2. We assume the redundancy mechanism to work at Shannon’s capacity. A message is denoted as ′ m ∈ {0, 1}M and its representative codeword as c ∈ {0, 1}M . For convenience, we use a slightly modified version of the sign function defined as: 1 if x > 0 sign(x) = (5) −1 else Importantly, note that sign(0) = −1. Lattice cells • (ak )k∈Z = 2k∆ and (bk )k∈Z = ak + ∆ are the boundaries of the coarse (∆) lattice cells. • (αk )k∈Z = ak + ∆−δ 2 and (βk )k∈Z = αk + δ are the boundaries of the fine (δ) lattice cells. • Pk ≜ 2(Φ(bk ) − Φ(ak )).
B
Formal Definitions
B.1
Watermarking systems
This appendix aims to make precise the informal definitions found in Section 2. A first reading of the paper can safely skip these details. However, note that the soundness of the evaluation framework and the corresponding proofs explicitly rely on the definitions found herein. For the reader’s convenience, we also collect definitions already provided in the main text. Definition B.1 (Embedding mechanism). An embedding mechanism e is a random variable that maps a message m ∈ {0, 1}M to a subset of the watermarked space Dm ⊂ RL . The induced probability distribution is denoted as Qm and called the watermarked distribution. 12
Note that Dm is to be understood as a subset of the decoding region of the decoder for message m: a good embedding mechanism favors mappings deep inside the correct decoding region in order to maximize robustness. Definition B.2 (Multi-bit watermarking System). A M -bit watermarking system W is a quadruplet (K, f, (ek )k∈K , d) where K is the set of secret keys, f : RD → RL the projection function, (ek )k∈K a family of embedding mechanisms indexed by secret keys and d : RL × K → {0, 1}M the decision mechanism. Definition B.3 (Redundancy mechanism). A redundancy mechanism is composed of an encoder and ′ a decoder (cenc , cdec ). The encoder cenc is a bijection between messages and a subset C ∈ {0, 1}M called the codebook. For each codeword c in the codebook, the decoder cdec defines an equivalence ′ ′ class [c] = {v ∈ {0, 1}M : cdec (v) = c} and where cdec : {0, 1}M . We will abuse notation and make no distinction between the equivalence class [c] and its representative codeword c. Definition B.4 (Error-corrected watermarking system). A M -bit watermarking system W equipped (c) with a redundancy mechanism (cenc , cdec ) replaces its embedding functions (ek )k∈K by ek ≜ ek ◦ cenc . The induced watermarked distribution are denoted as Q(k,c) . Its decision mechanism L M′ is replaced by a function d(c) ≜ c−1 . We call d(c) the enc ◦ cdec ◦ d where d : R × K → {0, 1} error-corrected decision mechanism; we still call d the decision mechanism. Definition B.5 (Cover distribution). Let P be a probability distribution with support in RD . It is said to be a cover distribution for a M -bit watermarking system W iff, for all secret keys k ∈ K: 1 d (f (X), k) ∼ B M , (6) 2 where X ∼ P and B M is a M -dimensional Bernoulli distribution. Definition B.6 (Seed-based system). A watermarking system equipped with cover distribution P is said to be seed-based if the projection of non-watermarked content in watermark space is distributed as a standard Gaussian. That is we have that: f (X) ∼ N (0, IL ), X ∼ P. B.2
Watermarking characteristic properties
Definition B.7 (Robustness). A projection function f is said to be σ-robust to a function t : RD → RD under an input distribution F (with support in RD ) iff : V[(f ◦ t)(X)] ≤ σ 2 , X ∼ F.
(7)
Definition B.8 (Decision channel characteristic). Let W be a M -bit error-corrected watermarking system with codeword size M ′ . The channel characteristic pk of W for a key k ∈ K is a mapping pk : R+ → [0, 1] defined as: 1 X pk (σ) = ′ M EZ∼Q(k,c) [Eϵσ [ham(d (Z + ϵσ , k) , d (Z, k))]] , (8) M2 c∈C
2
where ϵσ ∼ N (0, σ IL ) and ham is the Hamming distance. Definition B.9 (Fidelity of Seed-based watermarking). A watermarked distribution Q(k,c) of a seed-based watermarking system is said to be ζ-faithful iff: DKL (N (0, IL )||Q(k,c) ) ≤ ζ.
(9)
We call ζ the relative fidelity loss with respect to the Gaussian distribution. Definition B.10 (Security ratio). A M -bit error-corrected watermarking system W with codeword size M ′ is η-secure against an estimator ψ if it requires at least No = ηL watermarked observations ′ to estimate a fixed key k ∈ K better than randomly guessing. That is, for any codeword c ∈ {0, 1}M : 1 ηL = min{N | P[d eψk (N ) (c), k = c] > M ′ , N ∈ N+ } (10) 2 where ψk (N ) is an estimation of the key k based on N i.i.d. samples Z ∼ Q(k,c) . We call η the security ratio of W against ψ. If η = +∞, we say that W is perfectly secure against ψ. 13
C
Further discussion about the watermarking system modeling
C.1
Choice of channel model
We decided to model the decision mechanism as a binary symmetric channel BSCp instead of an additive white Gaussian noise AWGNσ . This choice does lead to a small loss in capacity: the "hard decision" prevents some capacity-achieving codes from reaching their full potential [12][Section C]. Nevertheless, this ultimately facilitates the analysis and comparisons to other multi-bit watermarking schemes. It also separates the choice of decision mechanism and coding mechanism, providing great flexibility in the choice of the latter depending on the desired properties needed for the watermarking system (e.g. maximal capacity versus cryptographic security). Shannon’s noisy channel coding theorem [26][Theorem 19.9], provides the sufficient (asymptotic) rate at which one must work to achieve an arbitrarily small probability of error2 . The strong converse theorem [26][Section 22.1 and Theorem 22.1] shows this rate to be necessary for the BSCp channel. Importantly, the error exponent converges exponentially fast to 0 or 1. This makes the asymptotic study of the channel straightforward since the actual value of the probability of decoding error does not matter: it can be as small (though not zero) as one desires for rates below capacity; the probability of error is essentially one for rates above capacity. The main quantity of interest thus becomes the flip probability p, which fully determines the capacity. Now, the flip probability p depends on two parts of the system: the robustness of the projection f , and the watermarked distribution Qk . In practice, an alteration in pixel space introduces some noise in watermark space. This noise will, in turn, impact p, with the impact depending on Qk . This is where we perform the decoupling between f and d. We measure the robustness of f against a transform t by the power σ 2 of the noise said transform introduces in watermark space – see Definition B.7 in the AppendixB. We finally define the decision channel characteristic pk of d as the mapping between σ 2 and p – see Definition B.8 in the Appendix B. The combination of both quantities leads to the Shannon capacity, which perfectly summarizes how much noise a watermarking system can resist for a given codeword size. C.2
Security, PCA attack and the Marchenko-Pastur distribution
This section relies on the threat model introduced in Section 3.2, instantiated for the SSB method described in Section 3.2. Setup Eve observes No watermarked samples in order to recover the secret key U. In this context, Eve’s best strategy is the Principal Components Analysis (PCA): Eve computes the empirical covariance matrix of the observations and performs an eigendecomposition, hoping that the directions of U appear as distinguishable principal components. PCA Given No observations, Eve computes the empirical covariance matrix Σ̂z = P Attack 1 ⊤ z z , and looks at its spectrum. In the absence of a watermark, the observations are i.i.d with i i i No a covariance matrix IL . Random matrix theory predicts that the empirical eigenvalues follow the Marchenko-Pastur (MP) distribution MP( NLo , 1). If the watermark leads to a covariance shift, so some eigenvalues depart from 1, the corresponding directions stand out as outliers relative to the expected MP distribution. Eve can use them to estimate U. Example analysis Figure 5 gives illustrative examples of eigenvalue distributions. First, Figure 5a illustrates the baseline, when no watermark is present in z. The empirical spectrum closely matches the MP distribution. When a watermark seed sampling is performed, the true covariance may not be the identity anymore. In the case illustrated by Figure 5b, the theoretical eigenvalues are λ0 = 1 for L − M ′ dimensions and λ1 = 1 − π2 for M ′ dimensions. For a sufficiently large No (10L in the figure), Eve observes two distinct MP distributions, each centered around one of these eigenvalues. By identifying the subspace associated with λ1 , Eve obtains an estimation of U, making the scheme 2We are aware of the recent non-asymptotic bounds on the capacity [25], but the Shannon regime conveniently allows an
analysis independent of probability of decoding error.
14
(b) (+∞, +∞)-SSB
(a) No watermark
(c) (1.6, 0)-SSB
Figure 5: Comparison between empirical and theoretical eigenvalues of the covariance matrix for different sampling of the seed. The empirical eigenvalues are computed over No = 10L samples with L = 512 and M ′ = 256. insecure for No observations. To satisfy the security ratio definition – Def. B.10 – the support of the watermarked empirical spectrum must be contained within the support of the non-watermarked MP distribution. This condition ensures that no outlier eigenvalue can betray a direction of U. This condition is achieved for all No when λo = λ1 = 1. Figure 5c illustrates this perfect-security regime for the (1.6, 0)-SSB scheme detailed in Appendix E. The empirical spectrum is indistinguishable from the unwatermarked case, so Eve gains no information about the secret key U.
D
Proofs
D.1
Fundamental properties of SSB
All the subsequent proofs rest on the fact that each element in watermarked elements in watermark space (zu )i are independent and distributed as an infinite mixture of truncated standard Gaussian random variables. For a given codeword c we always have: X (zu )i = sign(ci ) Pk Z k , (11) k∈Z
Zk ∼ TruncN[αk ,βk ] (0, 1) .
(12)
This is explicitly constructed in Alg.1 and as such does not need further proof. On the other hand, the watermarked distribution in the latent space Q(U,c) is more difficult to describe as a weighted sum of infinite mixtures. However, thanks to the nature U, it is simple to obtain the asymptotic watermarked distribution. First, we quantify the first two moments in the watermarked space. Proposition D.1.1 (Embedding distribution moments). Let (∆, δ) define a SSB system. Then we have that, for any zu ∼ Q(U,c) , E[zu ] ≜ µ(∆,δ) = sign(c)
+∞ X
Pk
k=−∞
Cov[zu ] ≜ Σ(∆,δ) = IL
+∞ X k=−∞
ϕ(αk ) − ϕ(βk ) , Φ(βk ) − Φ(αk )
! βk ϕ(βk ) − αϕ(αk ) 2 Pk 1 − − µu . Φ(βk ) − Φ(αk )
(13)
(14)
Proof. See Section D.5. Observing that all watermarked elements are independent and follow the same distribution up to a 2 sign, we note the unsigned expectation of (zu )i as µ(∆,δ) and its variance as σ(∆,δ) . From this, one can derive the asymptotic distribution of the watermarked latent, which is Gaussian if the weights of U are chosen suitably. We don’t provide an explicit solution for guaranteeing that U is "good" in this sense since in practice, one only has to ensure the entries of U are close to a uniform 15
distribution to ensure Lyapunov’s condition holds and that enough entries per row are non-zero. This ′ can be done by sampling a matrix in RL×M where each entry is sampled from a uniform distribution. Each column is then normalized such that they sum to 1. Importantly, note that the matrix where each column contains a single 1 is not a good matrix for SSB . Proposition D.1.2 (Asymptotic watermarked distribution). Let (∆, δ) define a SSB system with fixed key U and codeword c. We have that the watermarked distribution Q(U,c) converges as L → ∞ in distribution to a multivariate Gaussian distribution N (UT µ(∆,δ) , UT Σ(∆,δ) U) if U is chosen such that Lyapunov condition holds. Proof. We provide a sketch of the proof using a slightly weaker result where the infinite sums in Proposition D.1.1 are truncated such that |k| ≤ κ. For any choice of κ, the moments are then obviously finite since Φ(x) is strictly increasing and bounded away from zero and from one. Consequently, ∀|k| < κ, we always have Φ(βk ) − Φ(αk ) > 0. The proposition assumes Lyapunov condition to hold, which concludes the proof. D.2
Proposition 1: Capacity of a watermarking system
Proposition D.2.1 (Capacity of a watermarking system). Let t : RD → RD be a function. A watermarking system W with projection f that is σ-robust to t and with channel characteristic pk has a Shannon capacity Cσ = 1 − h2 (pk (σ)), where h2 is the binary entropy function. Proof. Since the decision mechanism is modeled as a binary symmetric channel with flip probability pk (σ), this the classic application of Shannon’s noisy channel coding theorem [26][Theorem 19.9] to a BSCp channel. D.3
Proposition 2 : SSB Channel characteristic
Proposition D.3.1 (SSB channel characteristic). Let (∆, δ) define a SSB system. Then the probability that a codeword bit is flipped due to a transform against which f is σ-robust is: h i R βj b −p − Φ akσ−p dp X X αj ϕ(p) Φ kσ (15) p(∆,δ) (σ) = 1 − 2 Pj Φ(βj ) − Φ(αj ) j=Z
k=Z
Proof. We denote by 1−p(∆,δ) (σ) the probability that a codeword bit is not flipped due to a transform against which f is σ-robust.
1 − p(∆,δ) (σ) =
X 1 Z βj j=Z
Zj
αj
" 2
X Z bk k=Z
ak
ϕ
x−p σ
# dx ϕ(p)dp,
(16) (17)
with Zj = Φ(βi ) − Φ(αi ) the normalizing constant. Then, we have: Z bk x−p bk − p ak − p ϕ dxϕ(p) ≜ Sk,σ (p) = Φ −Φ ϕ(p) σ σ σ ak
(18)
and the probability that a codeword bit is flipped due to a transform against which f is σ-robust is: p(∆,δ) (σ) = 1−2
X X 1 Z βj j=Z k=Z
Zj
bk − p ak − p Sk,σ (p)dp ; Sk,σ (p) = Φ −Φ ϕ(p) σ σ αj (19)
16
D.4
Proposition 3: SSB Asymptotic fidelity
Proposition D.4.1 (SSB Asymptotic relative fidelity). Any (∆, δ)-SSB system with codeword size M ′ is M ′ ζ(∆, δ)-faithful with h i L→∞ 1 −2 2 ζ(∆, δ) −−−−→ 1 + µ2(∆,δ) σ(∆,δ) + log σ(∆,δ) −1 , (20) 2 if U is chosen such that Lyapunov condition holds. Proof. This is a direct consequence of Proposition D.4 applied to Def.B.9 and observing that a standard Gaussian distribution is still a standard Gaussian in watermarked space since columns of U sum to 1. D.5
Proposition 4 ′
Proposition D.5.1 (SSB Watermarking security). Let α = ML . Any (∆, δ)-SSB is η-secure against a √ 2 1− ασ∆,δ PCA estimator where η = . 1−σ∆,δ Proof. SSB ’s security relies on eigenvalues of its covariance matrix, and if the number of observations is enough to observe a shift from the expected Marchenko-Pastur distribution. First, we compute the covariance matrix Σz . Σz = E[zz⊤ ]
(21)
= E[ (IL − UU⊤ )z + Uzu ⊤
= E[Uzu zu U
⊤
(IL − UU⊤ )z + Uzu
⊤
]
(22)
⊤ ⊤ ⊤ ] + E[Uzu z⊤ o ]E[zo zu U ] + E[zo zo ]
(23) (24)
⊤ ⊤ with zo = (IL − UU⊤ )z. Uzu and zo are independent, so E[Uzu z⊤ o ] = E[zo zu U ] = 0. Let’s ⊤ compute E[zo zo ]. T ⊤ T E[zo z⊤ o ] = E[(IL − UU )zz (IL − UU )] T
⊤
T
= (IL − UU )E[zz ](IL − UU ) T
T
= (IL − UU )(IL − UU )
(25) (26) (27)
T
(28) (29)
⊤ ⊤ ⊤ E[Uzu z⊤ u U ] = UE[zu zu ]U ,
(30)
= IL − UU .
⊤ It remains to calculate E[Uzu z⊤ u U ].
where E[zu z⊤ u ] is the covariance matrix of zu . As zu are independent, Cov(zu ) = V(zu )IM ′ . So, Σz is given by: ⊤ ⊤ Σz = UE[zu z⊤ u ]U + E[zo zo ]
= IL + (V(zu ) − 1) UU
⊤
(31) (32)
So eigenvalues are λ0 = 1 for (L − M ′ ) dimensions and λ1 = V(zu ) for M ′ dimensions. In a case of Gaussian sampling such that IL ), the eigenvalues follows a Marchenkoz ∼qN (0, q 2 2 L L Pastur distribution with support S = 1− N , 1+ N , with N the number of observations. Following the Marchenko-Pastur theory, the support of eigenvalues in watermarkq q 2 2 L−M ′ L−M ′ ing sampling is Sλ0 = 1− , 1+ for (L − M ′ ) dimensions and N N q 2 q 2 ′ M′ Sλ1 = λ1 1 − M , λ 1 + for M ′ dimensions. A watermarking scheme is η1 N N secure if Sλ1 ⊆ S. It gives the following condition: 17
If λ1 > 1: s !2 !2 M′ L λ1 1 + = 1+ η η s s ! ! p M′ L λ1 1 + = 1+ η η √ √ p λ1 M ′ L λ1 + √ =1+ √ η η √ √ p L − λ1 M ′ λ1 − 1 = √ η p √ √ p η( λ1 − 1) = L − λ1 M ′ √ √ L − λ1 M ′ √ √ η= λ1 − 1 2 √ 1 − ασu , η= 1 − σu s
′
with α = ML and σu =
√
(33)
(34) (35) (36) (37) (38) (39)
λ1 .
If λ1 ≤ 1: s λ1
1−
M′ η
!2 =
s !2 L 1− η
(40) (41)
so the proof is analogous. Then, we distinguish the two extreme cases for the computation of the eigenvalues. We know that λ1 = V(zu ).
E[zu ] = 2sign(c)
R βk
+∞ X
(Φ(bk ) − Φ(ak ))
k=−∞
= 2sign(c)
+∞ X
(Φ(bk ) − Φ(ak ))
k=−∞
= sign(c)
+∞ X
Pk
k=−∞
αk
xϕ(x)dx
Φ(βk ) − Φ(αk ) ϕ(αk ) − ϕ(βk ) Φ(βk ) − Φ(αk )
ϕ(αk ) − ϕ(βk ) , Φ(βk ) − Φ(αk )
(42)
(43)
(44) (45)
with Pk = 2(Φ(bk ) − Φ(ak )). and,
E[z2u ] = 2
+∞ X
R βk (Φ(bk ) − Φ(ak ))
k=−∞ +∞ X
αk
x2 ϕ(x)dx
Φ(βk ) − Φ(αk )
Φ(βk ) − βk ϕ(βk ) − Φ(αk ) + αk ϕ(αk ) Φ(βk ) − Φ(αk ) k=−∞ +∞ X βk ϕ(βk ) − αϕ(αk ) = Pk 1 − , Φ(βk ) − Φ(αk ) =2
(Φ(bk ) − Φ(ak ))
(46)
(47)
(48)
k=−∞
(49) 18
with Pk = 2(Φ(bk ) − Φ(ak )). Then, the covariance is given by: Cov(zu ) = IL V(zu )
(50)
= Il E[z2u ] − E[zu ]2 +∞ X
Pk 1 −
= IL
k=−∞
(51) βk ϕ(βk ) − αϕ(αk ) Φ(βk ) − Φ(αk )
! − µ2u
,
(52)
with µ2u = E[zu ]2 .
E
Perfect security of SSB
Figure 6: Perfect security regime with (1.6, 0)-SSB. An interesting behavior of SSB can be observed for the security ratio in Figure 3 around ∆ = 1.6 when using the finest lattice (δ → 0). The observed peak is due to Proposition 4, which states that if the eigenvalues of the watermarked covariance matrix are all 1, then one cannot estimate the secret rotation U, whatever how many samples we provide to Eve. A surprising fact is that SSB can achieve perfect security for non-zero capacities. Even better, for any ∆ < 1.6, one can find a corresponding δ > 0 for which it achieves perfect security. One further advantage of the perfect security regime is that it can be studied independently of the message size M and of the latent space dimension L: both fidelity and capacity are computed per latent element. We plot the watermarking characteristic under this regime in Figure 6.
F
Examples
Figure 7 illustrates examples of images generated with Sana with the compared multi-bit seed-based watermarking methods.
G
Reproducibility Statement
All models and datasets are detailed in Appendix H. All the simulations can be executed in the notebook provided as a supplementary file. The full code used for the experimental validation will be released upon acceptance. The implementation relies on PyTorch and Diffusers libraries, with fixed random seeds. All hyperparameters are provided in Section 4 to achieve the results presented in this work. Experiments were conducted on NVIDIA L40s GPUs for 20 hours. 19
No watermark
(1.6, 0)-SSB
(+∞, +∞)-SSB Gaussian-Shading
PRC
Figure 7: Example of images generated with Sana. Images were selected randomly.
H
Licenses
Datasets Stable-Diffusion-Prompts • Source: https://huggingface.co/datasets/Gustavosta/ Stable-Diffusion-Prompts • License: Unknown Pretrained Diffusion Models Sana • Source: https://huggingface.co/Efficient-Large-Model/Sana_600M_512px • License: NVIDIA License Z-image • Source: https://huggingface.co/Tongyi-MAI/Z-Image • License: apache-2.0 20
Qwen-Image • Source: https://huggingface.co/Qwen/Qwen-Image • License: apache-2.0 Augmentations Augly • Source: https://github.com/facebookresearch/AugLy • License: MIT License
21