AnchorMark: Robust Diffusion Watermarking via Latent-Space Rotation Synchrony Yuqi Qian1,2 , Yun Cao1,2 , Haocheng Fu1,2 , Haochen Zhao1,2 , Hong Zhang1,2 , Meineng Zhu3 , 1
Institute of Information Engineering, Chinese Academy of Sciences School of Cyber Security, University of Chinese Academy of Sciences 3 School of Cybersecurity, University of International Relations [email protected], [email protected], [email protected], [email protected], [email protected], [email protected] 2
arXiv:2607.27551v1 [cs.CR] 30 Jul 2026
Abstract Inversion-based watermarking embeds watermark payloads directly into the generative process, avoiding a separate posthoc image-domain embedding stage while preserving the native visual fidelity of synthesized images. However, existing methods remain vulnerable to compound lossy postprocessing, particularly when rotation is involved, as it disrupts the spatial correspondence required for latent-space decoding. To overcome this limitation, we introduce AnchorMark, a training-free, robust inversion-based watermarking. We uncover a latent-space property termed Rotation Synchrony: image-domain rotations and their counterparts in the recovered initial latent share the same angle. Building on this property, AnchorMark embeds a synchronization anchor in the central region of the initial latent, enabling accurate estimation and correction of the rotation angle during extraction. Experiments show that AnchorMark substantially improves bit accuracy under rotation and combined attacks, with limited impact on image quality.
Introduction Recent advances in diffusion models have substantially improved the quality and controllability of text-to-image generation (Ho, Jain, and Abbeel 2020; Song, Meng, and Ermon 2020; Rombach et al. 2022). Latent diffusion models such as Stable Diffusion can now synthesize realistic, semantically rich, and stylistically diverse images from natural-language prompts, while also raising concerns about content provenance, copyright protection, model-output authentication, and synthetic misinformation. Digital watermarking has become a crucial technique to address this need. Among existing paradigms, inversion-based watermarking is particularly appealing: it embeds payloads into the initial diffusion latent, allowing the watermark to be formed together with the image, and later recovers it through diffusion inversion. This formulation requires no retraining of the underlying generator and is robust to common non-geometric distortions (Wen et al. 2023; Yang et al. 2024; Qian et al. 2026). Nevertheless, their robustness deteriorates markedly under combinations of lossy post-processing operations, particularly when rotation is involved. As shown in Fig. 1, under rotations spanning Copyright © 2027, Association for the Advancement of Artificial Intelligence (www.aaai.org). All rights reserved.
0°
α
0.9989
45°
-45° 0.9905
0.9908
Original Image
Distorted Image
Diffusion Inversion
-90°
0.9991
0.9999
0.9590
α
0.7522
90°
0.9453
135°
-135° 180°
Standard Anchor
Recovered Anchor
RivaGAN (Posthoc-based)
StableSignature (Fine-tune-based)
GaussianShading (Inversion-based)
Ours (AnchorMark)
Figure 1: Intuitive comparison of AnchorMark with representative state-of-the-art methods from three watermarking paradigms. AnchorMark maintains high payload extraction accuracy across a wide range of rotation angles. −180◦ to 180◦ , the bit accuracy of representative watermarking methods drops toward 50% over a broad range of angles, indicating nearly random payload recovery rather than a gradual loss of watermark strength. The fundamental challenge is latent coordinate-frame misalignment: rotation shifts watermark carriers from their expected locations, breaking the spatial correspondence required for payload decoding. Prior work responds to rotationinduced misalignment in two different ways. Learned synchronizers explicitly estimate the applied transformation using auxiliary networks or predictors (Fang et al. 2025a), but require additional training and can make synchronization dependent on particular architectures, watermarking schemes, or training attack distributions. Rotation-invariant spectral designs instead avoid explicit transformation estimation by suppressing orientation sensitivity (Wen et al. 2023; Ci et al. 2024). Although effective for watermark-presence detection, such designs do not recover the correspondence between latent carriers and bit positions required to decode an ordered multi-bit payload. Inversion-based multi-bit watermarking therefore still lacks a lightweight and modular mechanism for watermarking synchronization. To address this challenge, we introduce AnchorMark as a training-free robust inversion-based watermarking. Inspired
by the classical rotation property of the Fourier transform, which maps an image-space rotation to the same angular rotation in the frequency domain, we investigate how rotation propagates through diffusion latent recovery. We uncover Rotation Synchrony in diffusion latent recovery: an image-space rotation induces the same angular rotation in the recovered initial latent. Consequently, matching the recovered latent against rotated references yields a minimum near the groundtruth angle. Based on this property, AnchorMark embeds a compact synchronization anchor in the central region of the initial latent while retaining the surrounding region for payload embedding. During recovery, the anchor guides rotation estimation and refinement, after which the aligned image is passed to the original decoder for payload extraction. The main contributions are summarized as follows: • We identify rotation-induced latent coordinate misalignment as a fundamental failure mode and formalize Rotation Synchrony: an image-space rotation induces the same angular rotation in the recovered initial latent. • We propose AnchorMark, a training-free robust inversion-based watermarking. It combines a compact multi-frequency phase anchor with statistics-calibrated injection, coarse-to-fine registration, and local refinement guided by payload verification to restore bit-wise alignment. • Extensive experiments demonstrate that AnchorMark consistently improves robustness against rotation attacks and enables reliable multi-bit payload recovery while preserving the visual quality and semantic fidelity of generated images.
Related Work Digital watermarking embeds traceable information into visual content while preserving perceptual quality. Classical transform-domain and neural post-hoc methods modify images after synthesis (Ingemar et al. 2008; Zhu et al. 2018; Zhang et al. 2019; Tancik, Mildenhall, and Ng 2020; Fernandez et al. 2022), whereas recent generative watermarking methods integrate the signal into the image-generation process. Stable Signature fine-tunes the latent decoder to produce signed images (Fernandez et al. 2023), while TreeRing, Gaussian Shading, and ShapeMark embed watermarks into the initial diffusion latent and recover them through inversion (Wen et al. 2023; Yang et al. 2024; Qian et al. 2026). CoSDA further improves this paradigm by reducing inversion drift and compensation errors (Fang et al. 2025b). Although effective against common non-geometric distortions, inversion-based multi-bit methods associate payload bits with spatially indexed latent carriers and are therefore vulnerable to rotation-induced misalignment. Geometric robustness has traditionally been addressed through synchronization references, feature-based registration, or invariant descriptors such as Fourier–Mellin features (Bas, Chassery, and Macq 2002). Recent learned methods explicitly predict geometric transformations (Fang et al. 2025a), but require additional training and may depend on specific architectures or attack distributions. Rotation-invariant spectral designs, such as Tree-Ring and RingID (Wen et al. 2023;
Ci et al. 2024), instead suppress orientation sensitivity to support stable watermark detection. However, multi-bit tracing requires recovering the correspondence between latent carriers and bit positions, which rotation-invariant aggregation does not provide. AnchorMark addresses this gap by preserving the spatially indexed latent structure and explicitly restoring its coordinate alignment for payload recovery.
Rotation Synchrony in Latent Space AnchorMark is grounded in a structural property of latent space that we term Rotation Synchrony: an image-space rotation induces the same angular rotation in the recovered initial latent. Prior work has shown that geometric transformations can remain systematically organized in learned representations (Lenc and Vedaldi 2015). Although standard CNNs are not strictly rotation-equivariant (Worrall et al. 2017), transformation-dependent spatial structures may persist in their feature spaces (Cohen and Welling 2016; Kouzelis et al. 2025).
Residual-Bounded Rotation Synchrony Let xT denote the initial diffusion latent, and let z0 = Φ(xT ) be the final latent produced by the deterministic sampling map Φ. Let E and D denote the VAE encoder and decoder, respectively, and let Ψ denote deterministic diffusion inversion. The generated image is I = D(z0 ). After applying an image-domain rotation Tα , the recovered initial latent is x̂T (α) = Ψ(E(Tα D(z0 ))) .
(1)
Throughout the analysis, Rα denotes the corresponding norm-preserving rotation on the continuous latent grid. Deviations introduced by finite-grid interpolation and finite spatial support are absorbed into the residual terms below. Definition 1 (Rotation Synchrony). Given a generated image–latent pair (I, xT ), the diffusion generation–inversion pipeline exhibits Bα -bounded Rotation Synchrony at angle α if ∥x̂T (α) − Rα xT ∥2 ≤ Bα . (2) Rotation Synchrony therefore characterizes an approximate cross-domain commutativity relation: rotating a generated image before latent recovery approximately agrees with directly rotating its initial latent. Importantly, this property does not assume exact rotation equivariance of either the VAE or the diffusion inversion dynamics. We first characterize the deviation introduced by VAE encoding. Its response to image rotation admits the decomposition E(Tα D(z0 )) = Rα z0 + rvae (α, z0 ),
(3)
where rvae quantifies the VAE-mediated deviation from ideal Rotation Synchrony, including reconstruction inconsistency, finite-resolution interpolation, and boundary effects. Equation (3) is an exact residual decomposition and does not assume that the VAE is rotation-equivariant. We next characterize how this rotational relation propagates through deterministic diffusion inversion. Following the ODE interpretation of deterministic diffusion trajectories
where ∥ξα ∥2 ≤ LΨ ∥rvae (α, z0 )∥2 ! Z T Z T + exp Lτ dτ ∥δs (α, x(s))∥2 ds (9) 0
s
+ ∥Ψ(Φ(xT )) − xT ∥2 .
Figure 2: Illustration of Rotation Synchrony: the initial latent recovered from a rotated image closely matches the correspondingly rotated initial latent of the original image.
(Song, Meng, and Ermon 2020; Song et al. 2020), we write the inversion dynamics as dx(t) = vt (x(t)), dt
x(0) = z0 ,
x(T ) = Ψ(z0 ). (4) We define the rotation-compatibility defect of the inversion vector field as δt (α, x) = vt (Rα x) − Rα vt (x).
(5)
If the inversion dynamics were exactly rotation-compatible, then δt (α, x) = 0. For a practical diffusion model, this quantity measures the discrepancy between rotating a latent before inversion and rotating the corresponding inversion trajectory. Assume that vt is locally Lipschitz along the relevant trajectories, with Lipschitz constant Lt . A standard Gronwall argument gives ∥Ψ(Rα z0 ) − Rα Ψ(z0 )∥2 ! Z T Z T ≤ exp Lτ dτ ∥δs (α, x(s))∥2 ds. 0
(6)
s
Thus, the inversion stage preserves the rotational relation required by Rotation Synchrony up to the accumulated rotationcompatibility defect of its vector field. The above analysis is stated for the continuous deterministic inversion flow; the corresponding finite-step DDIM formulation and its discretization residual are provided in the appendix. If the inversion map is locally Lipschitz in a neighborhood of Rα z0 , with constant LΨ , the VAE residual propagates according to ∥Ψ(Rα z0 + rvae ) − Ψ(Rα z0 )∥2 ≤ LΨ ∥rvae (α, z0 )∥2 .
Rotation Estimation via Latent Matching The above result motivates rotation estimation through latent matching. For a candidate angle β, let yα = Norm(x̂T (α)) ,
zβ = Norm(Rβ xT ) .
(10)
We define the practical and ideal matching distances as 1 2 ∥yα − zβ ∥2 , (11) N 1 2 Dideal (α, β) = ∥zα − zβ ∥2 . (12) N Without recovery residuals, yα = zα , and thus Drec = Dideal . For a reference latent without nontrivial rotational symmetry, Dideal (α, β) is minimized at β = α. Let 1 ϵα = √ ∥yα − zα ∥2 (13) N denote the normalized recovery deviation. By the reverse triangle inequality, p p Drec (α, β) − Dideal (α, β) ≤ ϵα . (14) Drec (α, β) =
Hence, the practical matching profile is a bounded perturbation of its ideal counterpart. When the VAE and inversion residuals are small, its minimum is expected to remain near the ground-truth rotation, which we verify empirically below.
Empirical Validation of Rotation Synchrony (7)
Combining Eqs. (6) and (7) yields the following residualbounded characterization of Rotation Synchrony. Proposition 1 (Residual-Bounded Rotation Synchrony). Under the above local Lipschitz conditions, for a generated image I = D(Φ(xT )) rotated by α, the inversion-recovered initial latent admits the decomposition x̂T (α) = Rα xT + ξα ,
The three terms respectively quantify the VAE-mediated rotation residual, the accumulated rotation-compatibility defect of the inversion dynamics, and the generation–inversion cycle error. Together, they characterize the deviation from ideal Rotation Synchrony. If all three terms vanish, Eq. (8) reduces to x̂T (α) = Rα xT , and the pipeline is exactly rotation-synchronous. In practical pipelines, Eq. (9) establishes the residual-bounded form of this property, with its right-hand side providing an explicit choice of Bα in Definition 1. The practical magnitude of these residuals, and whether they remain sufficiently small to support angle recovery, are examined empirically below.
(8)
We empirically assess whether Rotation Synchrony is sufficiently accurate to support angle recovery in pretrained diffusion pipelines. For each initial latent xT , we generate I = D(Φ(xT )), rotate it by a known angle α, and apply DDIM inversion to obtain x̂T (α). We then evaluate Drec (α, β) against candidate rotations Rβ xT , using the central valid region to reduce rotation-induced boundary artifacts. As shown in Fig. 3, both the sample-wise and averaged matching profiles attain their minima at the ground-truth
Figure 3: Empirical validation of Rotation Synchrony: latent matching is minimized near the ground-truth angle, producing a clear low-distance diagonal across rotations. angle or its nearest sampled candidate. The pairwise distance heatmap further exhibits a clear low-distance diagonal, providing a global signature of Rotation Synchrony. Consequently, α̂ = arg min Drec (α, β) ≈ α. (15) β
These results show that image rotation remains observable as the dominant orientation shift of the inversion-recovered initial latent, providing the empirical basis for AnchorMark to perform latent synchronization.
AnchorMark: Rotation Synchronization for Inversion-Based Watermarking In this section, we present AnchorMark, a training-free geometric synchronization framework for inversion-based diffusion watermark recovery. Building on the rotation correspondence established above, AnchorMark embeds a compact multi-frequency phase anchor in the central latent region through statistics-calibrated injection, while retaining the surrounding region for the original multi-bit payload. As illustrated in Fig. 4, recovery combines anchor-guided coarse-to-fine rotation synchronization with local refinement, reusing the original watermark decoder for candidate verification and final payload extraction after image-domain correction.
Decoupled Phase-Anchor Construction AnchorMark constructs an analytic orientation reference that is spatially decoupled from the data-bearing watermark payload. The construction follows three principles: isolating the synchronization cue from payload modulation, encoding rotation through a predictable multi-frequency phase response, and limiting perturbations to the initial latent through statistics-calibrated injection. Anchor–Payload Spatial Decoupling. Given an initial diffusion latent xT ∈ RC×H×W , AnchorMark reserves a compact central patch Ma for synchronization and a channel subset Sa ⊆ {1, . . . , C} for carrying the phase anchor. The resulting anchor support is therefore defined jointly by the central spatial region and the selected latent channels. Phase-anchor injection is restricted to this support, while the
underlying inversion-based watermarking method embeds its multi-bit payload in the remaining latent coordinates. This separation assigns synchronization and message carrying to disjoint latent supports, preventing payload modulation from overwriting the orientation reference and avoiding direct interference from the anchor with payload carriers. The anchor is placed at the latent center because centered image rotations preserve the central structure more consistently, whereas peripheral regions are more susceptible to padding, cropping, and interpolation artifacts. The central support therefore provides a stable and modular reference for subsequent rotation registration. Multi-Frequency Phase Encoding. Within the s × s anchor patch, each spatial position (u, v) is represented in polar coordinates relative to the patch center (uc , vc ): θ(u, v) = atan2(v − vc , u − uc ), p ρ(u, v) = (u − uc )2 + (v − vc )2 .
(16)
Let Ca = |Sa | and
Ca P = 2
(17)
be the number of available sine–cosine channel pairs. We select an ordered angular-frequency set K = {kj }P j=1 ,
1 = k1 < k2 < · · · < kP ≤ kmax , (18) where kmax is limited by the anchor resolution to avoid severe angular aliasing. The j-th harmonic pair is defined as cos kj θ(u, v) + ϕj Aj (u, v) = ω(ρ(u, v)) , (19) sin kj θ(u, v) + ϕj where ϕj is a predetermined phase offset and ω(ρ) is a radial envelope, with ω(ρ) = 1 when no radial tapering is applied. The two components of Aj are assigned to one latent-channel pair. This construction converts spatial rotation into an analytic phase response. Under a centered rotation by α, the angular coordinate changes from θ to θ − α, yielding Aj (θ − α) = Q(kj α)Aj (θ),
(20)
where Q(kj α) =
cos(kj α) − sin(kj α)
sin(kj α) . cos(kj α)
(21)
Thus, a rotation by α induces a predictable phase displacement of kj α in the j-th harmonic pair. The fundamental component k1 = 1 provides a stable global orientation reference with limited angular ambiguity, whereas higher-frequency components amplify small angular variations and sharpen local discrimination. Their combination forms a multi-scale phase code that supports both reliable coarse alignment and fine-grained rotation estimation.
Embedding Stage
1
2
Transmission
Decoding Stage
3
Multi-Frequency Phase Anchor Construction
Anchor-Guided Rotation Synchronization
Low-frequency Anchor
High-frequency Anchor Conditioned Phase Structuring
Suspect Image
Recovered Latent
Verifier
Anchor Reference
Anchor Reference
Anchor Injection & Watermark Payload Embedding
Local Refinement
Anchor–Payload Partition
JPEG Compression Resize/Rescale
- 2°
- 1°
+1°
Coarse-to-Fine Search
Performance Evaluation +2°
Payload Region Initial Latent
PhaseSync Anchor Region
+ 1°
Conf ( - 1°) = 0.85
Conf (
Gaussian Noise
- 2° Rotation
Text Prompt
Watermarked Image
Filtering
) = 0.92
Blur
Diffusion Models
Watermarked Latent
Conf ( - 2°) = 0.71
Watermarked Latent
Watermarked Image Generation A puppy is drinking Starbucks.
- 2°
Crop
Color/Contrast
- 1°
+1°
+ 1°
Conf ( +1°) = 0.97
+ 2°
Conf ( +2°) = 0.81
+2°
Verification & Tracing Synchronous
Verification
Correction
Tracing
Final Correct Angle 𝛾 ∗ + 1°
Corrected Image
Watermark Payload
Figure 4: Overall pipeline of AnchorMark. A multi-frequency phase anchor is injected into the initial diffusion latent together with the watermark payload; after transmission under common distortions, the recovered anchor guides coarse-to-fine rotation synchronization and local refinement for reliable payload verification and tracing. Statistics-Calibrated Anchor Injection. Directly overwriting the initial latent with a deterministic phase template may introduce a substantial distribution shift and degrade image generation. AnchorMark instead embeds the anchor through per-channel moment matching, weak mixing, and post-mixing calibration. Let xa = xT [Ma ] denote the original latent patch, and let A denote the corresponding multi-frequency phase template. For each selected channel c, the template is first standardized and matched to the mean and standard deviation of the original latent patch: Ãc =
Ac − µ(Ac ) , σ(Ac ) + ϵ
A∗c = σ(xa,c )Ãc + µ(xa,c ), (22)
where µ(·) and σ(·) denote the empirical mean and standard deviation. The matched template is then fused with the original latent through p x′a,c = 1 − λ2 xa,c + λA∗c , (23) where λ controls the strength of the synchronization cue. A smaller λ reduces disturbance to the original latent, whereas a larger value strengthens the recoverable phase response. Finally, the mixed patch is recalibrated to the original perchannel moments: x′a,c − µ(x′a,c ) x′′a,c = σ(xa,c ) + µ(xa,c ). (24) σ(x′a,c ) + ϵ The calibrated patch x′′a is written back to the anchor support of xT . This procedure approximately restores the
original per-channel mean and variance up to the numerical stabilizer while retaining the structured phase component required for synchronization. Because the phase code and its injection are fully analytic, the anchor can be constructed without learned parameters or modifications to the diffusion model.
Hierarchical Rotation Synchronization and Payload Recovery AnchorMark restores the latent coordinate frame through a hierarchical recovery procedure that combines two complementary signals. The phase anchor supports efficient rotation estimation over a wide angular range, whereas the original watermark decoder provides a task-specific criterion for resolving the remaining fine-grained uncertainty. Accordingly, AnchorMark first performs phase-anchor-guided global registration and then conducts payload-confidence-guided local refinement before final message recovery. Anchor-Guided Global Registration. Given an attacked image Iatt , AnchorMark first maps it back to the initial diffusion latent space:x̂T = Inv(Iatt ), and extracts the recovered anchor region x̂a = x̂T [Ma ]. Using the shared key, the detector reconstructs the reference anchor xref a . For each candidate attack angle γ ∈ Ω, the reference anchor is spatially rotated in the latent domain and compared with the recovered anchor through the normalized matching loss Lanchor (γ) = MSE Norm(x̂a ), Norm Rγ (xref , (25) a ) where Rγ (·) denotes latent-domain rotation. The initial rotation estimate is obtained as γ ∗ = arg minγ∈Ω Lanchor (γ). To
cover a broad rotation range without exhaustively evaluating a dense angle grid, AnchorMark searches Ω in a coarse-tofine manner. Because this stage only rotates and compares compact latent anchors after a single inversion, it provides an efficient global estimate of the rotation-induced coordinate misalignment. Payload-Guided Local Refinement. Although anchorguided registration estimates the dominant rotation, small errors may remain because of finite search resolution, image interpolation, and diffusion inversion noise. Such residual misalignment can still disrupt the spatial correspondence required for multi-bit decoding. AnchorMark therefore constructs a compact local candidate set Ωv around the initial estimate γ ∗ and refines it using the native verification criterion of the underlying watermarking method. For each γ ∈ Ωv , the attacked image is inversely rotated by −γ, mapped back to the initial latent space, and processed by the original payload decoder. Because AnchorMark confines synchronization to the central anchor region, the surrounding payload support and its native decoding rule remain unchanged. The payload recovered from this surrounding region is assigned the corresponding verification confidence Conf(γ), and the final synchronization angle is selected as α̂ = arg max Conf(γ). γ∈Ωv
The payload decoded at α̂ is returned as the final recovery result. This hierarchical design uses the central phase anchor for wide-range synchronization and the surrounding native payload for task-aligned local refinement.
Experiments Experimental Settings Unless otherwise specified, experiments use Stable Diffusion v2.1 at 512 × 512 resolution with a 4 × 64 × 64 initial latent. Images are generated with 50 denoising steps and a classifierfree guidance scale of 7.5. Watermark recovery uses 10-step DDIM inversion with a null prompt, assuming the original generation prompt is unavailable. AnchorMark uses a 16 × 16 central anchor over all four latent channels. The multifrequency phase anchor contains two sine–cosine pairs with K = {1, 3}, phase offsets (ϕ1 , ϕ2 ) = (0, 0.7), and injection strength λ = 0.2. Phase-anchor-guided global registration uses a 5◦ coarse grid followed by 1◦ refinement within ±3◦ . Payload-confidence-guided local refinement searches within ±2◦ using a 0.5◦ step. All experiments are conducted on an NVIDIA L40 GPU.
Evaluation Metrics Following (Yang et al. 2024), we evaluate both watermark detection and tracing. Detection performance is measured by the true positive rate (TPR) at a fixed false positive rate of 10−6 , while tracing performance is measured by bit accuracy (Acc). Configurable multi-bit methods use a 256-bit payload; methods with fixed capacity follow their official settings and released weights. TPR and Acc are evaluated on 500 randomly sampled prompts from Stable-DiffusionPrompts (Gustavosta 2022). Image quality and text–image
consistency are assessed using FID (Heusel et al. 2017) and CLIP-Score (Radford et al. 2021), computed on 1,000 COCO2017 prompts (Lin et al. 2014).
Baselines We compare AnchorMark with representative post-hoc methods, including DwtDctSvd (Ingemar et al. 2008) and RivaGAN (Zhang et al. 2019); the fine-tuning-based Stable Signature (Fernandez et al. 2023); and inversion-based methods, including Tree-Ring (Wen et al. 2023), RingID (Ci et al. 2024), Gaussian Shading (Yang et al. 2024), and ShapeMark (Qian et al. 2026). Detailed baseline configurations are provided in the appendix.
Main Results: Comprehensive Rotation-Robustness Comparison We evaluate rotation robustness in both detection and tracing settings. Each ±θ◦ setting evaluates both +θ◦ and −θ◦ rotation attacks, and the reported results are averaged over the two directions. Table 1 reports TPR/Acc under different rotation magnitudes, together with FID and CLIP-Score for image quality and semantic fidelity. Rotation attacks severely degrade existing watermarking methods, especially inversionbased multi-bit schemes without synchronization: Gaussian Shading almost loses detection capability beyond small rotations, and both Gaussian Shading and ShapeMark keep tracing accuracy close to random guessing. By contrast, AnchorMark restores this coordinate frame through latent registration before decoding. With AnchorMark, Gaussian Shading achieves near-perfect detection and an average Acc of 97.66%, while ShapeMark reaches almost perfect recovery across all tested rotations, including ±60◦ . Meanwhile, the changes in FID and CLIP-Score remain limited compared with the corresponding base methods, indicating that AnchorMark provides accurate geometric correction while preserving visual quality and text-image semantic fidelity.
Robustness under Combined Attacks While the main comparison focuses on isolated rotations, real editing pipelines often combine rotation with resizing, compression, noise, or filtering. These compound attacks are more challenging because they simultaneously disrupt spatial alignment and degrade the anchor or payload signal. We therefore evaluate AnchorMark under randomized combined attacks across SDv1.5, SDv2.1, SDv3.5 Medium, and FLUX.1-dev. For each test image, we randomly compose one rotation with one additional image-level distortion. The rotation angle is sampled from {15◦ , 30◦ , 45◦ }, covering moderate to large geometric misalignment. The second distortion is sampled from five common post-processing operations: upscaling by 1.25×, downscaling by 0.9×, JPEG compression with quality factor 75, Gaussian noise with σ = 0.01, and median blur with kernel size 5. This randomized protocol avoids evaluating only manually selected attack pairs and better reflects practical editing scenarios where geometric and photometric degradations may appear jointly. We report the average TPR and Acc over all randomly sampled combined attacks. Table 2 summarizes the results. AnchorMark
Table 1: Main comparison under rotation attacks. For each rotation magnitude, we report TPR / Acc, where TPR is evaluated at FPR = 10−6 and Acc denotes bit-level tracing accuracy. “–” indicates not applicable. FID and CLIP-Score are reported as mean ± standard deviation. Rotation Attack: TPR / Acc ↑
Method ◦
FID ↓
CLIP ↑
57.2958 ± 0.9591
0.3080 ± 0.0015
±5
±10◦
±30◦
±60◦
–
–
–
–
DwtDctSvd RivaGAN Stable Signature Tree-Ring RingID
0.3511/0.5215 0.9971/0.9974 0.9692/0.9620 0.9560/– 0.8700/–
0.3394/0.5152 0.9928/0.9898 0.8827/0.7230 0.6780/– 0.8840/–
0.3115/0.5069 0.6151/0.6358 0.6429/0.5833 0.2700/– 0.7800/–
0.3153/0.5127 0.3992/0.4875 0.5193/0.5416 0.5120/– 0.7340/–
Gaussian Shading + AnchorMark ShapeMark + AnchorMark
0.0140/0.5658 0.0000/0.5523 0.0000/0.5040 0.0000/0.5018 58.0626 ± 0.5199 0.3088 ± 0.0004 0.9900/0.9750 1.0000/0.9822 1.0000/0.9802 0.9960/0.9689 59.2894 ± 1.0701 0.3082 ± 0.0012 0.5600/0.5098 0.5820/0.5122 0.4540/0.5001 0.4200/0.4990 56.4198 ± 0.7918 0.3096 ± 0.0011 1.0000/1.0000 1.0000/1.0000 1.0000/0.9999 1.0000/1.0000 57.4025 ± 0.8211 0.3088 ± 0.0012
Stable Diffusion v2.1
maintains stable detection and tracing performance across all evaluated backbones, showing that the proposed synchronization mechanism is not tied to a specific diffusion architecture or latent distribution. More importantly, the results demonstrate that AnchorMark remains effective when rotation is coupled with common image-level distortions. This indicates that the phase anchor provides a sufficiently robust synchronization cue, and that the two-stage correction-andextraction strategy can still recover the payload after realistic compound transformations. Table 2: Average TPR / Acc under randomized combined attacks across text-to-image backbones. Each attack combines a rotation from {15◦ , 30◦ , 45◦ } with a randomly selected resize, JPEG, Gaussian noise, or median blur distortion. TPR / Acc ↑
Backbone
Gaussian Shading + AnchorMark ShapeMark + AnchorMark Stable Diffusion v1.5 Stable Diffusion v2.1 Stable Diffusion v3.5 FLUX.1-DEV
0.9981 / 0.9642 0.9980 / 0.9598 0.9980 / 0.9527 0.9979 / 0.9454
1.0000 / 0.9768 1.0000 / 0.9722 1.0000 / 0.9641 0.9999 / 0.9678
Ablation Study on Phase Anchor Design We ablate the phase-anchor template to verify whether the proposed multi-frequency design is necessary. All variants use the same anchor region, injection strength, and decoding strategy, and differ only in the injected synchronization pattern. We compare a statistics-matched random anchor, a low-frequency anchor using only the k = 1 harmonic, a highfrequency anchor using only the k = 3 harmonic, and the full multi-frequency anchor combining both components. Table 3 shows that the random anchor remains partially effective: since it is key-dependent and spatially fixed, it can still provide a certain matching signal after rotation. However, it lacks an analytic phase response, leading to less accurate angle estimation and lower tracing accuracy. The low-frequency anchor improves stability and achieves better accuracy than the random anchor, while the high-frequency
56.7683 ± 0.9571 0.3122 ± 0.0015 56.8412 ± 0.9864 0.3108 ± 0.0014 57.5137 ± 1.0388 0.3068 ± 0.0015 58.6148 ± 0.9949 0.3081 ± 0.0014 58.1896 ± 0.8413 0.3048 ± 0.0013
anchor provides stronger angular sensitivity but is more affected by interpolation and inversion noise. The full multifrequency anchor yields the best performance, reducing the angle estimation error to less than 0.5◦ . These results confirm that AnchorMark benefits from the structured combination of low-frequency robustness and high-frequency discrimination, rather than merely from inserting an additional latent pattern. Table 3: Ablation study of the phase-anchor design under rotation attacks. Angle Error (◦ ) ↓
Anchor Design
TPR / Acc ↑
Gaussian Shading + AnchorMark Random 0.4975 Low-frequency only 0.4450 High-frequency only 0.4050 Full multi-frequency 0.3980
0.9850 / 0.9388 0.9950 / 0.9529 0.9900 / 0.9510 0.9980 / 0.9598
ShapeMark + AnchorMark Random Low-frequency only High-frequency only Full multi-frequency
1.0000 / 0.9432 1.0000 / 0.9581 1.0000 / 0.9488 1.0000 / 0.9722
0.6820 0.5710 0.6070 0.4929
Conclusion We presented AnchorMark, a training-free robust inversionbased watermarking. AnchorMark embeds a multi-frequency phase anchor into the initial diffusion latent and restores the correct spatial coordinate frame through hierarchical rotation synchronization and payload recovery. Experiments show that AnchorMark significantly improves multi-bit tracing under rotation and combined attacks while preserving image quality and semantic fidelity. These results demonstrate that latent-space synchronization is an effective mechanism for robust inversion-based watermarking under geometric transformations.
References Bas, P.; Chassery, J.-M.; and Macq, B. 2002. Geometrically invariant watermarking using feature points. IEEE transactions on image Processing, 11(9): 1014–1028. Ci, H.; Yang, P.; Song, Y.; and Shou, M. Z. 2024. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification. In European conference on computer vision, 338–354. Springer. Cohen, T.; and Welling, M. 2016. Group equivariant convolutional networks. In International conference on machine learning, 2990–2999. PMLR. Fang, H.; Chen, K.; Ma, Z.; Deng, J.; Li, Y.; Zhang, W.; and Chang, E.-C. 2025a. SynTag: Enhancing the Geometric Robustness of Inversion-based Generative Image Watermarking. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 15416–15425. Fang, H.; Chen, K.; Yang, Z.; Cui, B.; Zhang, W.; and Chang, E.-C. 2025b. CoSDA: Enhancing the Robustness of Inversion-based Generative Image Watermarking Framework. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, 2888–2896. Fernandez, P.; Couairon, G.; Jégou, H.; Douze, M.; and Furon, T. 2023. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 22466–22477. Fernandez, P.; Sablayrolles, A.; Furon, T.; Jégou, H.; and Douze, M. 2022. Watermarking images in self-supervised latent spaces. In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 3054–3058. IEEE. Gustavosta. 2022. Stable Diffusion Prompts Dataset. https://huggingface.co/datasets/Gustavosta/StableDiffusion-Prompts. Accessed: 2026-01-23. Heusel, M.; Ramsauer, H.; Unterthiner, T.; Nessler, B.; and Hochreiter, S. 2017. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems, 30. Ho, J.; Jain, A.; and Abbeel, P. 2020. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33: 6840–6851. Ingemar, J. C.; Miller, M. L.; Jeffrey, A. B.; Fridrich, J.; and Kalker, T. 2008. Digital watermarking and steganography. Elsevier Inc. Kouzelis, T.; Kakogeorgiou, I.; Gidaris, S.; and Komodakis, N. 2025. Eq-vae: Equivariance regularized latent space for improved generative image modeling. arXiv preprint arXiv:2502.09509. Lenc, K.; and Vedaldi, A. 2015. Understanding image representations by measuring their equivariance and equivalence. In Proceedings of the IEEE conference on computer vision and pattern recognition, 991–999. Lin, T.-Y.; Maire, M.; Belongie, S.; Hays, J.; Perona, P.; Ramanan, D.; Dollár, P.; and Zitnick, C. L. 2014. Microsoft coco: Common objects in context. In European conference on computer vision, 740–755. Springer.
Qian, Y.; Cao, Y.; Fu, H.; Lv, M.; and Zhu, M. 2026. ShapeMark: Robust and Diversity-Preserving Watermarking for Diffusion Models. arXiv preprint arXiv:2603.09454. Radford, A.; Kim, J. W.; Hallacy, C.; Ramesh, A.; Goh, G.; Agarwal, S.; Sastry, G.; Askell, A.; Mishkin, P.; Clark, J.; et al. 2021. Learning transferable visual models from natural language supervision. In International conference on machine learning, 8748–8763. PMLR. Rombach, R.; Blattmann, A.; Lorenz, D.; Esser, P.; and Ommer, B. 2022. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 10684– 10695. Song, J.; Meng, C.; and Ermon, S. 2020. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502. Song, Y.; Sohl-Dickstein, J.; Kingma, D. P.; Kumar, A.; Ermon, S.; and Poole, B. 2020. Score-based generative modeling through stochastic differential equations. arXiv preprint arXiv:2011.13456. Tancik, M.; Mildenhall, B.; and Ng, R. 2020. Stegastamp: Invisible hyperlinks in physical photographs. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2117–2126. Wen, Y.; Kirchenbauer, J.; Geiping, J.; and Goldstein, T. 2023. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust. arXiv preprint arXiv:2305.20030. Worrall, D. E.; Garbin, S. J.; Turmukhambetov, D.; and Brostow, G. J. 2017. Harmonic networks: Deep translation and rotation equivariance. In Proceedings of the IEEE conference on computer vision and pattern recognition, 5028–5037. Yang, Z.; Zeng, K.; Chen, K.; Fang, H.; Zhang, W.; and Yu, N. 2024. Gaussian shading: Provable performance-lossless image watermarking for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 12162–12171. Zhang, K. A.; Xu, L.; Cuesta-Infante, A.; and Veeramachaneni, K. 2019. Robust invisible video watermarking with attention. arXiv preprint arXiv:1909.01285. Zhu, J.; Kaplan, R.; Johnson, J.; and Fei-Fei, L. 2018. Hidden: Hiding data with deep networks. In Proceedings of the European conference on computer vision (ECCV), 657–672.