Official Review · ICLR 2024

This paper tackles the problem of Generative Diffusion Models (GDM) using unauthorized images as training data and learns the style/distribution of those unauthorized images. This paper introduces DiffusionShield, a watermark to protect data copyright. It is motivated by the observation that "pattern uniformity" can effectively assist the watermark to be captured by GDMs. This pattern uniformity is how uniform the watermark patterns are. That is, lower variance in watermark patterns can cause GDMs to learn watermark features before the actual features. By enhancing the pattern uniformity of watermarks and leveraging a joint optimization method, DiffusionShield successfully secures copyright with better accuracy and a smaller budget. Theoretic analysis and experimental results demonstrate the superior performance of DiffusionShield originality: the paper proposes a novel approach to watermarking the images to prevent malicious GDMs from using the training data without authorization. The method is simple and effective, supported by theoretical and experimental results. quality: this paper is technically sound, both theoretical and experimental results are provided to support the claims. clarity: this paper is well-written and well-organized. the presentation is great. significance: this paper is significant and addresses a very important problem in the field of GDMs -- data copyright protecting. GDMs nowadays are strong enough to learn any data distribution and able to replicate some novel images using the style of the creator without crediting. This is because there is no proof that the GDMs have used the images from the creator. This paper proposes a simple but robust method to help protect the creator's copyright on the data they own. I notice this method mostly describes adding a watermark to the original images instead of the latent space which is commonly used by existing GDMs such as Stable Diffusion (SD). Although there is a section describing fine-tuning a SD and adding watermarks to the latent space, there is much less visualization/analysis on it. The author can provide more examples/analysis of adding a watermark to latent space and how it will affect the VAE encoding/decoding process. Further, the author can provide the cost of watermarking the images and it maybe not be likely that a content creator has the resources to watermark the images. Finally, I think there is less analysis on how DiffusionShield can protect against the removal attack --- if the malicious took the watermarked data, perform some augmentations on the data. Will the watermark still able to be detected? 1. If the malicious took the watermarked data, perform some augmentations on the data. Will the watermark still able to be detected? 2. How about the feature distribution of the watermarked images? Although little pixel changes are not visible to the human eyes but may be more obvious in the feature distribution of some feature extractors.