Image watermarking

Overview

An image watermark embeds a secret message in pixels, so a later detector can tell whether an image came from a given model or user 2303.15435 §1. Two tests are common. Detection asks whether an image came from the model, and identification asks which user key it carries 2303.15435 §3.

The shared problem is that a watermark added after generation can be removed once the generator is leaked or open-sourced 2303.15435 §1. The shared invariant is the statistical test: the detector counts matching bits against a threshold chosen for a target false-positive rate, and the rate depends on the bits of unmarked images being close to independent fair coin flips 2303.15435 §3.1 2303.15435 §4.1.

Variants

In-generation watermark by decoder fine-tuning

The model provider fine-tunes only the decoder of a latent diffusion model, so every output carries a fixed key of 48 bits 2303.15435 §4.2. A pre-trained extractor reads the key, and it is trained with simulated distortions so it survives common edits 2303.15435 §4.1. Generation runs unchanged, because the diffusion process works in latent space and never calls the decoder 2303.15435 §4.2. The authors report under 500 fine-tuning images and about one minute on one GPU for each key 2303.15435 §4.2. Card: The Stable Signature.

Per-user keys give identification. The paper fine-tunes one decoder per key, then picks the best of N keys for an image, with a threshold that rises as N grows 2303.15435 §3.2 2303.15435 §5.2.

When to use which

The paper's removal results depend on the attacker. Neural auto-encoder removal needs strong distortion to reach near-50% bit accuracy, and white-box removal with the extractor available needs less budget 2303.15435 §7.1. Purification by decoder fine-tuning is hard without visible artifacts 2303.15435 §7.2. These results come from the authors' threat models and are not a general security claim.

Implementation sketch

The common core is the detection test. Variants differ in how the key gets into the pixels, not in the test.

# Detect a key m in an image  [arxiv:2303.15435 §3.1] [arxiv:2303.15435 §4.1]
# Input:  image x; key m with k bits; threshold tau
# Output: True if the image is flagged

def detect(image, key, tau):
    # Hard bits from the extractor's soft outputs  [arxiv:2303.15435 §4.1]
    bits = extractor(image) > 0
    # Count bits that match the key  [arxiv:2303.15435 §3.1]
    matches = count(bits == key)
    return matches >= tau

The threshold tau comes from the false-positive rate. Under independent fair bits, the rate is a binomial tail over k bits 2303.15435 §3.1. The paper's own rule and tail formula differ by one matching bit, so pick one and use it consistently 2303.15435 §3.1.

Contradictions

• Abstract versus body on crops. The abstract reports over 90% accuracy for a 10% crop at FPR below 1e-6, but the body does not state that figure directly and points to its detection plot 2303.15435 abstract 2303.15435 §5.1.
• Quality weight versus robustness. Higher λ_i keeps images closer to the original decoder but lowers bit accuracy under the combined edit 2303.15435 §6.5. The default λ_i = 2.0 lies outside the swept range, so the quality and robustness numbers in the main table do not state which weight produced them 2303.15435 §4.2 2303.15435 tab. 1 2303.15435 tab. 3.
• Extractor bit independence. The false-positive rate assumes independent bits. The paper says the whitened extractor is close to that, and that its empirical rate is slightly higher below 1e-6, which is conservative 2303.15435 app. B.5 2303.15435 app. B.6. For the comparison baseline, the authors say HiDDeN's bits are not independent, so its guarantees do not hold 2303.15435 §6.4.

Papers

• The Stable Signature: Rooting Watermarks in Latent Diffusion Models: in-generation watermarking by fine-tuning the latent diffusion decoder, with per-user identification and a binomial test.