Published as a conference paper at ICLR 2026
FARI: ROBUST O NE -S TEP I NVERSION FOR WATER MARKING IN D IFFUSION M ODELS Jindong Yang1,2 , Han Fang1,2∗ , Weiming Zhang1,2 , Nenghai Yu1,2 , Kejiang Chen1,2∗ University of Science and Technology of China 2 Anhui Province Key Laboratory of Digital Security [email protected] {ynh, zhangwm, chenkj, fanghan}@ustc.edu.cn 1
arXiv:2607.26723v1 [cs.CR] 29 Jul 2026
A BSTRACT Inversion-based watermarking is a promising approach to authenticate diffusiongenerated images, yet practical use is bottlenecked by inversion that is both slow and error-prone. While the primary challenge in the watermarking setting is robustness against external distortions, existing approaches over-optimize internal truncation error, and because that error scales with the sampler step size, they are inherently confined to high-NFE (number of function evaluations) regimes that cannot meet the dual demands of speed and robustness. In this work, we have two key observations: (i) the inversion trajectory has markedly lower curvature than the forward generation path does, making it highly compressible and amenable to low-NFE approximation; and (ii) in inversion for watermark verification, the trade-off between speed and truncation error is less critical, since external distortions dominate the error. A faster inverter provides a dual benefit: it is not only more efficient, but it also enables end-to-end adversarial training to directly target robustness, a task that is computationally prohibitive for the original, lengthy inversion trajectories. Building on this, we propose FARI (Fast Asymmetric Robust Inversion), a one-step inversion framework paired with lightweight adversarial LoRA fine-tuning of the denoiser for watermark extraction. While consolidation slightly increases internal error, FARI delivers large gains in both speed and robustness: with approximately 20 minutes of fine-tuning on a single NVIDIA RTX A6000 GPU, it surpasses 50-step DDIM inversion on watermark-verification robustness while dramatically reducing inference time. Code and pretrained models are available at https://github.com/0xD009/FARI.
1
I NTRODUCTION
The rapid proliferation of diffusion models (Ho et al., 2020; Song et al., 2021) has led to an explosion of AI-generated content, simplifying creative production but also fueling the spread of synthetic misinformation and raising concerns about intellectual property protection for model providers. In response, inversion-based watermarking (Yang et al., 2024; Wen et al., 2023; Huang et al., 2024; Gunn et al., 2024) has shown remarkable promise for authenticating and tracing diffusion-generated images. By embedding a watermark in the initial noise, the mark becomes deeply integrated with the image’s semantics during the iterative generation process, ensuring minimal visual impact. To extract the watermark, the image typically needs to be reconstructed back to noise via inversion techniques (Song et al., 2021; Hong et al., 2024). This inversion step, however, is the method’s critical bottleneck. It is computationally expensive, time-consuming, and introduces substantial errors, all of which hinder the practical, large-scale deployment of inversion-based watermarks. This bottleneck motivates the development of a fast and accurate inversion method tailored for watermark extraction. Although many inversion techniques (Mokady et al., 2023; Hong et al., 2024; Wallace et al., 2023) exist, most primarily aim to reduce internal inversion error (caused by discretization truncation and Classifier-Free Guidance) via iteration (Pan et al., 2023; Garibi et al., 2024; Samuel et al., ∗
Corresponding authors.
1
Published as a conference paper at ICLR 2026
2023), optimization (Hong et al., 2024; Li et al., 2024; Mokady et al., 2023), or analytical control of truncation-error bounds (Wallace et al., 2023; Zhang et al., 2024a; Wang et al., 2024). While effective for diffusion-based image editing (Hertz et al., 2022), this strategy is ill-suited for watermarking. Prior to extraction, images may be subjected to diverse distortions (e.g., JPEG compression, blur) that induce substantial initial-condition shifts; given the denoiser’s sensitivity, these perturbations compound rapidly along the inversion trajectory and become the dominant bottleneck to extraction accuracy. This shift in the error bottleneck for watermark extraction leads us to question the necessity of traditional high-NFE inversion. In prior methods, which primarily address clean-image scenarios, performance is limited by the discretization truncation error of the ODE sampler, which is directly related to the step size. Consequently, a high NFE is required to maintain precision. In the watermarking context, however, this internal error is dwarfed by the accumulated error from external distortions, a factor that is not explicitly mitigated by a larger number of steps. Furthermore, the natural solution to instill this robustness, adversarial training, is blocked by the high NFE of these traditional inverters. A powerful end-to-end training regime is rendered computationally infeasible by the prohibitive memory costs of backpropagating through a long iterative process. Meanwhile, the more computationally feasible, factorized objective, similar to that used in diffusion pretraining (Ho et al., 2020), proves insufficient for learning the global robustness required to counter complex distortions (see Appendix E.3). These facts indicate that first finding a low-NFE solution is not only beneficial for speed, but also enables a breakthrough in enhancing robustness. Motivated by this, we propose FARI: Fast Asymmetric Robust Inversion, a framework that achieves fast and robust inversion tailor-made for watermarking at a minimal fine-tuning cost. FARI is based on a key insight into the geometric asymmetry between generation and inversion trajectories: while the estimation error in inversion makes the reconstructed noise inaccurate, it also indirectly endows the inversion path with a significantly lower curvature than its generation counterpart. A lower-curvature trajectory is inherently easier to approximate with fewer steps. This enables a stepdistillation approach that collapses multi-step inversion into a single efficient step. This reduction in NFE unlocks efficient end-to-end adversarial training. While this distillation-based estimation slightly sacrifices precision on clean, distortion-free inversion, the direct speed-up and the indirect enhancement in robustness are substantial, and we find that the downside of this trade-off has a negligible effect on the performance of the downstream watermarking task (Yang et al., 2024; Wen et al., 2023). Furthermore, our use of LoRA (Hu et al., 2022) for fine-tuning elegantly avoids the degradation of image quality. By storing the learned robustness knowledge externally in the LoRA parameters, we can simply deactivate the LoRA branch during generation, ensuring that the original model’s generation quality remains unchanged. Our experiments demonstrate that with just 20 minutes of fine-tuning on a single NVIDIA RTX A6000 GPU, the one-step FARI surpasses the robustness of the 50-step DDIM baseline in watermark verification tasks.
2
BACKGROUND
2.1
D IFFUSION M ODELS
Diffusion models (Ho et al., 2020; Song et al., 2021) are a class of generative models that operate by iteratively transforming a pure Gaussian noise vector zT ∼ N (0, I) into a real data sample z0 ∼ q(z) through T denoising steps. The process is defined by two Markov chains. The forward process gradually diffuses a data sample z0 by adding Gaussian noise over T timesteps according to a fixed variance schedule {βt }Tt=1 : p q(zt |zt−1 ) = N (zt ; 1 − βt zt−1 , βt I), (1) A key property of this process is that we can sample zt at any arbitrary timestep t directly from z0 : √ √ zt = ᾱt z0 + 1 − ᾱt ϵ, (2) Qt where αt = 1 − βt , ᾱt = i=1 αi , and ϵ ∼ N (0, I). The reverse process learns to denoise these corrupted samples to recover the original data. This is achieved by training a neural network ϵθ to predict the added noise ϵ from the noisy input zt . The objective function is typically a simplified version of the evidence lower bound: L(θ) = Ez0 ,t∼Uniform(1,T ),ϵ∼N (0,I) ∥ϵ − ϵθ (zt , t)∥22 , (3) 2
Published as a conference paper at ICLR 2026
2.2
DDIM S AMPLING AND I NVERSION
The denoising diffusion implicit model (Song et al., 2021) (DDIM) provides a deterministic sampling process by defining a non-Markovian forward process that leads to the same marginal distributions. Given a noisy latent zt , DDIM computes the subsequent latent zt−1 by first predicting an estimate of the clean image, ẑ0 , and then stepping towards it: √ zt − 1 − ᾱt ϵθ (zt , t) √ ẑ0 = , (4) ᾱt p √ (5) zt−1 = ᾱt−1 ẑ0 + 1 − ᾱt−1 ϵθ (zt , t). The deterministic nature of DDIM is crucial as it allows for an invertible generation process, which iteratively computes zt from zt−1 by reversing the sampling steps. This unique invertible characteristic allows us to recover the initial noise representation zT from any generated image z0 , which serves as a powerful tool for inversion-based watermarking. 2.3
I NVERSION -BASED WATERMARKING FOR D IFFUSION M ODELS
We categorize these methods into three classes. The first class, epitomized by Tree-Ring (Wen et al., 2023), embeds a robust pattern into the Fourier domain of the initial noise to enable detection. Subsequent works have focused on enhancing its practical applications or extending its capabilities. For instance, RingID (Ci et al., 2024) extends it to a multi-bit watermark, ROBIN (Huang et al., 2024) improves its imperceptibility, and ZoDiac (Zhang et al., 2024b) generalizes it as a post-processing watermark, all without altering the core embedding and extraction logic. The second class, represented by Gaussian Shading (Yang et al., 2024), embeds a multi-bit watermark into the spatial domain of the noise through distribution-preserving sampling. Follow-up research has concentrated on improving its key reuse problem, as seen in PRC-Watermark (Gunn et al., 2024) and Gaussian Shading++ (Yang et al., 2025), and on functional extensions; for example, TAG-WM (Chen et al., 2025) and VideoShield (Hu et al., 2025) provide functionality for detecting tampered regions. The third class, such as GaussMarker (Li et al., 2025), combines the first two approaches to compensate for their weakness against geometric distortions. 2.4
I NVERSION M ETHODS
There is a substantial body of work on diffusion model inversion. Methods such as BELM (Wang et al., 2024), BDIA (Zhang et al., 2024a), and EDICT (Wallace et al., 2023) directly modify the sampling process to make it invertible. Others, including AIDI (Pan et al., 2023), ExactDPM (Hong et al., 2024), and ReNoise (Garibi et al., 2024), employ iteration or gradient descent to obtain better intermediate values for trajectory alignment. A third category, which includes NTI (Mokady et al., 2023) and NPI (Miyake et al., 2025), focuses on optimizing a better null-text embedding to guide the regeneration process. As we have previously mentioned, these methods are primarily designed for training-free image editing. Consequently, they may fail in adversarial watermark extraction scenarios, a point we will demonstrate in our experiments section. 2.5
D IFFUSION M ODEL ACCELERATION
The acceleration of diffusion models can be broadly categorized into two paths. The first path involves using solvers with lower truncation error (Lu et al., 2022a;b; Zhang & Chen, 2022). While these methods can reduce the number of inference steps to between 20 and 30, the quality of image generation in extreme few-step scenarios (e.g., < 10) remains unsatisfactory. A noteworthy method in this category is the AMED-Solver (Zhou et al., 2024a), which is based on the mean value theorem. It uses a small model to predict the timestep where the mean value occurs, thereby estimating the average velocity and enabling generation in as few as two steps. The second path is distillation, where a student model is trained to replicate the output of multiple teacher steps in a single step. Techniques such as progressive distillation (Salimans & Ho, 2022), consistency distillation (Song et al., 2023), and distribution matching distillation (Yin et al., 2024b;a) follow this paradigm. However, these methods typically demand a substantial amount of pre-generated training data, GPU memory, and time. 3
Published as a conference paper at ICLR 2026
3
O UR P ROPOSED M ETHOD
In this section, we propose FARI, a robust one-step inversion method designed for watermark extraction. It is based on our key finding that the inversion trajectory exhibits a significantly lower curvature than the generation path does, enabling efficient one-step distillation, which in turn makes the adversarial fine-tuning computationally feasible. 3.1
T HE I NVERSION T RAJECTORY E XHIBITS L OWER C URVATURE
We begin with the inherent systematic error in DDIM inversion (Song et al., 2021). For deterministic DDIM sampling, the denoising process, which computes zt−1 from zt , can be written in a single recurrence relation(the conditioning terms are omitted for simplicity): s r p ᾱt−1 ᾱ (1 − ᾱ ) t−1 t zt−1 = zt + 1 − ᾱt−1 − ϵθ (zt , t). (6) ᾱt ᾱt The inversion step, which solves for zt based on zt−1 , is derived as: s ! r √ ᾱt ᾱt (1 − ᾱt−1 ) 1 − ᾱt − zt−1 + ϵθ (zt , t). zt = ᾱt−1 ᾱt−1
(7)
However, since our goal is to solve for zt , the term ϵθ (zt , t) on the right-hand side of Eq. 7 cannot be explicitly calculated. Generally, this is addressed by making a piecewise linear assumption, approximating ϵθ (zt , t) ≈ ϵθ (zt−1 , t). The validity of this assumption, however, requires a sufficiently small step size, a condition that practical settings often fail to meet. This becomes a significant source of inversion error, even for clean images. While many works (Lin et al., 2024; Wang et al., 2024; Staniszewski et al., 2024) have recognized that changes in the trajectory direction ϵθ (·) cause an offset of the reconstructed noise ẑT and have attempted to mitigate this asymmetry, we further point out that under the combined effect of directional and positional offsets, curvature—a higherorder property of the trajectory—also exhibits a profound asymmetry. Specifically, the curvature of the inversion trajectory is substantially lower than that of the denoising trajectory.
generation inversion
10 Curvature
8 6 4 2 0 Image
Latent
Residual
0
MSE Error (compared to NFE=50)
Curvature over Sampling
200 400 600 800 1000 Timestep
0.20
NFE Tolerance Generation Inversion
0.15 0.10 0.05 0.00
3 6 9 12 15 NFE (Number of Function Evaluations)
Figure 1: Left: Visualization of the inversion error, where latent vectors are projected down to 3 channels via PCA for display. Middle: Curvature of generation and inversion trajectories across diffusion timesteps. Discrete curvature estimated using 100 unconditionally generated images from Stable Diffusion v2.1. Right: The resulting error for generation and inversion when reducing the NFE, compared with a 50-step NFE baseline. In Figure 1(middle), we illustrate the curvature differences between the 1000-step denoising (generation) and inversion trajectories. We observe that trajectories exhibit greater curvature near the noise end of the process (as t → T ). This is because the denoising network is trained on the forward diffusion process, where different images can diffuse to the same noise point, causing trajectory crossing (Lee et al., 2023). Consequently, in the early stages of denoising, the model must constantly correct its direction, leading to high curvature (Lee et al., 2023). This effect is particularly pronounced at the 4
Published as a conference paper at ICLR 2026
Denoiser
0101...
0101...
Watermark Encoding
VAE Distortion
Watermark Content
LoRA
N-step Generation
MSE Loss Watermark Decoding
1-step Inversion VAE
Watermark Pipeline (Disabled during traning)
Backpropagation
trainable
frozen
Figure 2: The framework of FARI. FARI simultaneously performs one-step distillation and adversarial training through a unified, end-to-end, LoRA-based fine-tuning process, enhancing both the efficiency and robustness of the inversion. The LoRA adapters are injected into the denoiser network and are deactivated during generation but activated for inversion. This strategy prevents any degradation of the original model’s generation quality and eliminates the need to deploy a second, complete denoiser, making it highly memory-efficient.
very beginning when the latent variable is nearly pure noise. Once the fundamental semantics of the image have formed, the direction of progress becomes relatively fixed, and the trajectory’s curvature decreases significantly. However, this high-curvature phenomenon is substantially less pronounced during the inversion process. We attribute this partly to the fact that the accumulated error during inversion retains low-frequency information from the source image. As shown in Figure 1(left), partial outlines of the image remain visible in the noise reconstruction error, an observation consistent with prior work (Lin et al., 2024; Staniszewski et al., 2024; Nguyen et al., 2025). This residual semantic information helps to more accurately determine the correct direction of progress as the inversion approaches the noise end. In general, a trajectory with lower curvature can be more accurately approximated with fewer linear steps (i.e., a lower NFE), as curvature is strongly correlated with the truncation error of the numerical solver. In the simple case where the curvature is zero, a single sampling step is sufficient. This key finding motivates us to explore the change in precision as the NFE is reduced for both generation and inversion. We decreased the NFE from 15 to 3, observing the deviation from the results of a standard 50-step NFE. The results in Figure 1(right) confirm that the inversion trajectory can indeed tolerate a much lower NFE, which provides the foundational premise for our proposed method by offering a significant increase in processing speed and, crucially, by enabling efficient adversarial training. 3.2
FARI
Guided by the geometric intuition that the inversion trajectory is highly compressible, our method is simple and effective. In essence, our strategy is to first find a low-NFE approximation of the DDIM inversion (Song et al., 2021) trajectory and then perform adversarial training upon this condensed path to achieve both speed and robustness. We use distillation, a common technique for accelerating diffusion models, to achieve the first step. While standard trajectory distillation (Salimans & Ho, 2022; Song et al., 2023; Yin et al., 2024a) for the generation process often requires days or even dozens of GPU-days and substantial memory, the favorable geometric properties of the DDIM inversion trajectory allow us to obtain a reasonably accurate low-NFE estimate with minimal effort. Although this initial estimate has some error (see Figure 3), we find this trade-off is acceptable in exchange for the immense gains in robustness and speed, and it has a negligible effect on the performance of the downstream watermarking tasks. For simplicity and efficiency, we do not explicitly separate the distillation and adversarial fine-tuning into two distinct stages, as they share a consistent optimization objective and converge rapidly. It is crucial to note our departure from common distillation practices for the generation process. We 5
Published as a conference paper at ICLR 2026
do not start with a real image and train our one-step model to mimic the output of a 50-step DDIM inversion. Instead, we sample a ground-truth Gaussian noise vector, perform the full generation process to obtain an image, and then learn a direct one-step mapping from this generated image back to the ground-truth initial noise. This approach avoids the performance ceiling imposed by the inherent inaccuracies of the 50-step DDIM inversion itself and is better aligned with the generative nature of the watermarking scenario.
h = W0 z + ∆W z = W0 z + BAz.
(8)
By decomposing the full-rank matrix into the product of two low-rank matrices, LoRA significantly reduces the number of trainable parameters, thereby lowering memory usage.
MSE over Timesteps DDIM Inversion(50 steps, Clean) DDIM Inversion(50 steps, Jpeg) FARI(Ours) (1 step, Clean) FARI(Ours) (1 step, Jpeg)
0.4 0.3 (zt zt)2
Specifically, we fine-tune the denoising network of the diffusion model using Low-Rank Adaptation (LoRA) (Hu et al., 2022), a parameter-efficient fine-tuning technique that updates pretrained weight matrices through low-rank decomposition. Given a weight matrix W0 ∈ Rd×k , the update is represented as W0 + ∆W = W0 + BA, where B ∈ Rd×r , A ∈ Rr×k , and the rank r ≪ min(d, k). During training, W0 is frozen, and gradient updates are applied only to A and B. The modified forward pass for an input z becomes:
0.2 0.1 0.0
0
200
400 600 Timestep
800
1000
Figure 3: Inversion trajectory error of FARI and DDIM on clean and JPEGcompressed images.
As illustrated in Figure 2, each training loop proceeds as follows. We randomly sample an initial noise vector zT ∼ N (0, I) and a condition c from a dataset C to generate an image X. During this generation phase, the LoRA branch is deactivated. The resulting image is then subjected to a distortion D(·) randomly selected from a predefined set T , yielding a distorted image X D , which is then encoded by the VAE encoder into a latent representation z0D . Subsequently, the LoRA branch is activated to perform a one-step inversion, which reconstructs the noise according to the following formula: s r √ ᾱ ᾱ (1 − ᾱ ) T T 0 ϵθ (z0D , 0, ∅; ψ). ẑTD = (9) z D + 1 − ᾱT − ᾱ0 0 ᾱ0 Since ᾱ0 = 1, this formula can also be equivalently written in the form of Eq.2: √ √ ẑTD = ᾱT z D 1 − ᾱT ϵθ (z0D , 0, ∅; ψ), 0 +
(10)
where ψ represents the LoRA parameters. For the inversion process, we use an unconditional setting (guidance scale = 1.0 and a null prompt). Prior works (Mokady et al., 2023; Wallace et al., 2023) have demonstrated that for standard DDIM inversion, an unconditional setting is often more precise because of the lack of invertibility in Classifier-Free Guidance (Ho & Salimans, 2022) (CFG). It is also important to note that we set the timestep t = 0 in the formula, rather than t = T as expected from Eq. 7. This is because in a single-step scenario, the piecewise linear assumption is clearly violated. Empirically, we find that any other small timestep value (t ≈ 0) can achieve performance comparable to t = 0, providing a much better match for the latent z0D , reducing the initial error and improving convergence. Finally, our training objective is defined as: (11) min EzT ,c∈C,D∈T ∥zT − ẑTD ∥22 ψ
Similarly, after training is complete, we deactivate the LoRA branch during denoising inference to preserve the original generation quality and enable it only for watermark extraction. This strategy is memory-efficient, eliminating the need to deploy two separate, largely identical denoisers. It is worth noting that the LoRA component can be regarded as a plug-and-play enhancement module. Even when it is removed, DDIM in principle allows inversion with arbitrary step counts, but the error may be very large. Further discussions, including details on the fine-tuned modules, training strategies, and hyperparameter selection, are provided in the ablation studies (Section4.4) and the Appendix E.3. 6
Published as a conference paper at ICLR 2026
4
E XPERIMENTS
4.1
I MPLEMENTATION D ETAILS
Diffusion Models. We selected Stable Diffusion v1.5 and v2.1 (Rombach et al., 2022) to cover the requirements of both the inversion baselines and the downstream watermarking task. For generation, we use a guidance scale of 7.5 and a number of function evaluations (NFE) of 50, employing the DDIM scheduler for all generations, except for those inversion methods that rely on their own specific sampling procedures. Watermarking Methods. We conduct experiments with Tree-Ring (Wen et al., 2023) (TR) and Gaussian Shading (Yang et al., 2024) (GS), which embed watermarks in the frequency and spatial domains of the initial noise, respectively. Comparison Methods. We evaluate our method against several categories of baselines for a comprehensive comparison. First, we establish standard benchmarks using 50-step DDIM inversion and one-step DDIM inversion. Next, we compare against methods specifically designed for highfidelity inversion, including EDICT (Wallace et al., 2023) and BELM (Wang et al., 2024). We also consider ExactDPM (Hong et al., 2024), but owing to its extremely slow inference speed, we limit this comparison to the SD v2.1 model. Finally, given the scarcity of dedicated few-step inversion techniques, we adapt state-of-the-art acceleration methods originally designed for generation. For fast numerical solvers, we select AMED-Solver (Zhou et al., 2024a). Among the distillation-based methods, we include LCM-LoRA (Luo et al., 2023) and DMD2 (Yin et al., 2024a). Since the publicly available weights for these methods are limited to SD v1.5, these comparisons are performed only on that version. A detailed justification for our choice of baselines and a discussion of other related works are provided in the Appendix A. Training. We train our model for 1,000 steps on 1,000 prompts from the MS-COCO-2017 dataset (Lin et al., 2014). The training is configured with a batch size of 4 and a learning rate of 1e-4. For LoRA, we use a rank of 8 and inject the adapters only into the attention-related modules. During the training loop, images are generated using an accelerated 20-step DDIM process to improve efficiency. Our adversarial distortion set includes 9 different augmentation types. Evaluation. We evaluate all methods on a test set of 1,000 prompts from the Stable-DiffusionPrompts (SDP) dataset1 under a range of common distortions. To accurately assess practical performance, we bypass general image-level metrics and instead adopt the specific evaluation metrics defined by the downstream watermarking methods themselves. Specifically, for Gaussian Shading, we measure the bit-wise accuracy of the extracted message; for Tree-Ring, we measure the TPR at a stringent fixed FPR of 10−3 , obtained by fitting the ROC curve on 1,000 positive and negative examples each and extrapolating. All experiments are implemented in PyTorch 2.4.1 and run on a single NVIDIA RTX A6000 GPU. More details can be found in Appendix B. 4.2
M AIN R ESULTS
The main results are presented in Table 1. Across both diffusion models and both downstream watermarking tasks, our FARI method achieves the most robust performance with the lowest NFE. As anticipated, the performance of EDICT (Wallace et al., 2023) and BELM (Wang et al., 2024) on noise reconstruction is not as strong as their reported performance on image reconstruction. Their results are often inferior even to the standard DDIM baseline. This is particularly true for BELM; as a multi-step method, its errors appear to accumulate more rapidly, and it exhibits a significant sensitivity to mismatched guidance scales between the generation and inversion phases. ExactDPM (Hong et al., 2024), which uses gradient descent to optimize the inversion trajectory, is extremely time-consuming but does show effectiveness against certain distortions like Gaussian noise. However, its objective is often misaligned with our task. For distortions involving missing content, such as random cropping or dropping, the method’s attempts to inpaint the image can cause the trajectory to deviate in the wrong direction, harming noise reconstruction. 1
https://huggingface.co/datasets/Gustavosta/Stable-Diffusion-Prompts
7
Published as a conference paper at ICLR 2026
Table 1: Comparison of inversion methods on downstream watermarking methods under various image distortions. DM
Methods
NFE
Clean
Adv.
Jpeg
R.Crop
R.Drop
Resize
G.Blur
M.Blur
G.Noise
S&P
Bright
SD v2.1
SD v1.5
Bit Accuracy of Gaussian Shading Watermark DDIM
50 1 EDICT 50 BELM 50 AMED† 2 LCM-LoRA 2 DMD2 1 FARI(Ours) 1
0.9999 0.9999 1.0000 0.9991 1.0000 0.9999 0.9988 1.0000
0.9777 0.9376 0.9637 0.9465 0.9656 0.9541 0.9287 0.9834
0.9889 0.9703 0.9786 0.9847 0.9807 0.9819 0.9760 0.9935
0.9781 0.8859 0.9656 0.8960 0.9528 0.9352 0.8446 0.9777
0.9736 0.8808 0.9568 0.8958 0.9462 0.9308 0.8241 0.9761
0.9975 0.9906 0.9969 0.9939 0.9970 0.9924 0.9792 0.9990
0.9873 0.9585 0.9807 0.9617 0.9808 0.9668 0.9209 0.9957
0.9983 0.9934 0.9985 0.9956 0.9989 0.9955 0.9836 0.9992
0.9609 0.9398 0.9390 0.9355 0.9587 0.9311 0.9252 0.9836
0.9354 0.9105 0.9124 0.9275 0.9346 0.9030 0.9007 0.9649
0.9567 0.9085 0.9450 0.9278 0.9410 0.9504 0.9336 0.9612
DDIM
50 1 EDICT 50 BELM 50 † AMED 2 ExactDPM > 150 FARI(Ours) 1
1.0000 0.9987 1.0000 0.9990 1.0000 1.0000 1.0000
0.9755 0.9359 0.9585 0.9411 0.9662 0.9670 0.9824
0.9892 0.9755 0.9773 0.9847 0.9813 0.9831 0.9941
0.9752 0.8841 0.9639 0.8923 0.9559 0.9675 0.9771
0.9669 0.8637 0.9558 0.8938 0.9495 0.9599 0.9700
0.9980 0.9748 0.9963 0.9933 0.9970 0.9974 0.9992
0.9860 0.9173 0.9805 0.9602 0.9805 0.9815 0.9956
0.9991 0.9819 0.9983 0.9952 0.9989 0.9987 0.9994
0.9590 0.9280 0.9396 0.9333 0.9585 0.9653 0.9815
0.9373 0.9069 0.9104 0.9269 0.9357 0.9241 0.9659
0.9447 0.9284 0.9395 0.9334 0.9384 0.9354 0.9588
DDIM
50 1 EDICT 50 BELM 50 AMED† 2 LCM-LoRA 2 DMD2 1 FARI(Ours) 1
1.000 1.000 1.000 0.933 1.000 1.000 1.000 1.000
0.949 0.863 0.942 0.592 0.909 0.875 0.760 0.997
0.989 0.905 0.975 0.768 0.939 0.914 0.709 1.000
1.000 0.602 0.998 0.032 0.947 0.996 0.116 1.000
1.000 0.649 1.000 0.054 0.936 0.991 0.473 1.000
0.999 1.000 0.999 0.889 0.999 0.999 0.996 1.000
0.996 0.994 0.992 0.873 0.995 0.987 0.971 1.000
1.000 1.000 0.997 0.865 0.999 0.999 0.995 1.000
0.636 0.891 0.605 0.384 0.618 0.331 0.913 0.980
0.946 0.990 0.954 0.852 0.912 0.812 0.985 1.000
0.972 0.737 0.962 0.608 0.835 0.850 0.678 0.992
DDIM
1.000 1.000 1.000 0.882 1.000 1.000 1.000
0.962 0.896 0.946 0.543 0.926 0.906 0.997
0.993 0.896 0.980 0.721 0.966 0.991 0.999
1.000 0.709 0.984 0.001 0.957 0.571 1.000
1.000 0.845 0.985 0.000 0.983 0.847 1.000
1.000 1.000 0.997 0.803 1.000 1.000 1.000
0.997 0.993 0.990 0.787 0.998 0.999 0.999
1.000 0.999 0.998 0.801 1.000 1.000 1.000
0.726 0.903 0.681 0.417 0.656 0.835 0.979
0.982 0.991 0.969 0.812 0.983 0.992 0.999
0.960 0.729 0.933 0.541 0.795 0.915 0.993
SD v2.1
SD v1.5
TPR@1e-3 of Tree-Ring Watermark
50 1 EDICT 50 BELM 50 † AMED 2 ExactDPM > 150 FARI(Ours) 1
The acceleration methods also show limitations. The AMED-Solver† (Zhou et al., 2024a), which we fine-tuned adversarially in a similar manner to FARI, performs competitively. However, because its mechanism is limited to predicting a single median timestep, its solution space is too constrained to handle complex, real-world distortions, leaving a gap to the optimal performance. The distillation methods, LCM-LoRA (Luo et al., 2023) and DMD2 (Yin et al., 2024a), while highly effective for accelerating generation, do not transfer their success to the distinct task of one-step inversion. We posit that this is because predicting the reverse ODE direction from a highly structured image is a fundamentally different challenge than predicting it from pure noise. 4.3
G ENERALIZATION
In this section, we explore FARI’s generalization ability to different generation conditions. By default, we use the SD v2.1 model (Rombach et al., 2022) for these experiments and employ the standard 50-step DDIM inversion (Song et al., 2021) as the baseline. Experiments with different samplers and NFE in generation process can be found in Appendix E. Guidance Scales. Given diverse user preferences for prompt adherence, higher guidance scales enforce the original prompt more strictly, while lower scales allow greater creative freedom. Our experiments span a wide range of 2.5 to 12.5. As shown in Figure 4(j), FARI’s performance degrades only marginally under these settings. Noise Intensities. To further test the robustness, we conduct experiments using different intensities of distortions. The results are shown in Figure 4(a-i). FARI consistently outperforms the standard DDIM baseline, and its advantage becomes even more pronounced as the distortion intensity increases. Noise types. Although our model is trained with a rich set of augmentations, real-world distortions may include types unseen during training. To evaluate FARI’s generalization ability against such unseen distortions, we compare the mean squared error (MSE) of the reconstructed noise under three 8
Published as a conference paper at ICLR 2026