---
kind: concept
slug: image-watermarking
title: Image watermarking
summary: >-
  Makes a generator's images carry a hidden key so a detector can later flag them or name the user who made them. One approach, in-generation watermarking, fine-tunes the decoder of a latent diffusion model so no separate step is needed. Author-reported: 0.99 bit accuracy on unmodified output, 0.92 after a combined crop, brightness and JPEG edit.
tags: [watermarking, provenance, image-generation, latent-diffusion]
papers: ["2303.15435"]
related: [text-watermarking, ai-generated-text-detection, latent-diffusion, text-to-image-generation]
status: draft
updated_at: 2026-10-24
---

## Overview

An image watermark embeds a secret message in pixels, so a later detector can
tell whether an image came from a given model or user [arxiv:2303.15435 §1].
Two tests are common. Detection asks whether an image came from the model, and
identification asks which user key it carries [arxiv:2303.15435 §3].

The shared problem is that a watermark added after generation can be removed
once the generator is leaked or open-sourced [arxiv:2303.15435 §1]. The
shared invariant is the statistical test: the detector counts matching bits
against a threshold chosen for a target false-positive rate, and the rate
depends on the bits of unmarked images being close to independent fair coin
flips [arxiv:2303.15435 §3.1] [arxiv:2303.15435 §4.1].

## Variants

### In-generation watermark by decoder fine-tuning

The model provider fine-tunes only the decoder of a latent diffusion model, so
every output carries a fixed key of 48 bits [arxiv:2303.15435 §4.2]. A
pre-trained extractor reads the key, and it is trained with simulated
distortions so it survives common edits [arxiv:2303.15435 §4.1]. Generation
runs unchanged, because the diffusion process works in latent space and never
calls the decoder [arxiv:2303.15435 §4.2]. The authors report under 500
fine-tuning images and about one minute on one GPU for each key
[arxiv:2303.15435 §4.2]. Card: [The Stable Signature](/papers/2303.15435).

Per-user keys give identification. The paper fine-tunes one decoder per key,
then picks the best of N keys for an image, with a threshold that rises as N
grows [arxiv:2303.15435 §3.2] [arxiv:2303.15435 §5.2].

## When to use which

| Situation | Use | Why |
|---|---|---|
| You own a latent diffusion model and want no per-image step | In-generation decoder fine-tuning | Watermarking happens inside the decoder, and the paper reports 0 s added per image [arxiv:2303.15435 §6.4] [arxiv:2303.15435 tab. 1] |
| You must tag images from several customers | Per-user keys with identification | The paper reports 98% identification accuracy at 10^5 users on unmodified images, and 40% after the combined edit [arxiv:2303.15435 §5.2] |
| Images are likely to be cropped, brightened or recompressed | Expect lower bit accuracy, and set the threshold on that edit | Combined edit: 0.92 bit accuracy; masked-only inpainting drops to 0.76 to 0.89 [arxiv:2303.15435 tab. 1] |
| You need a strict false-positive bound | Detection at a fixed FPR with the binomial test | The paper uses FPR 1e-6 for identification and reports detection down to 1e-9 [arxiv:2303.15435 §5.1] [arxiv:2303.15435 §5.2] |
| You cannot change the generator | Post-generation watermarks | Not covered by a card here. The paper's comparison names DCT-DWT, SSL Watermark, FNNS and HiDDeN, which the authors ran as post-generation baselines [arxiv:2303.15435 §6.4] |
| Commercial deployment from the paper alone | Implement from the paper | The authors' released code is non-commercial, so it should not be reused; see the [paper card](/papers/2303.15435) |

The paper's removal results depend on the attacker. Neural auto-encoder
removal needs strong distortion to reach near-50% bit accuracy, and
white-box removal with the extractor available needs less budget
[arxiv:2303.15435 §7.1]. Purification by decoder fine-tuning is hard without
visible artifacts [arxiv:2303.15435 §7.2]. These results come from the
authors' threat models and are not a general security claim.

## Implementation sketch

The common core is the detection test. Variants differ in how the key gets
into the pixels, not in the test.

```pseudocode
# Detect a key m in an image  [arxiv:2303.15435 §3.1] [arxiv:2303.15435 §4.1]
# Input:  image x; key m with k bits; threshold tau
# Output: True if the image is flagged

def detect(image, key, tau):
    # Hard bits from the extractor's soft outputs  [arxiv:2303.15435 §4.1]
    bits = extractor(image) > 0
    # Count bits that match the key  [arxiv:2303.15435 §3.1]
    matches = count(bits == key)
    return matches >= tau
```

The threshold tau comes from the false-positive rate. Under independent fair
bits, the rate is a binomial tail over k bits [arxiv:2303.15435 §3.1]. The
paper's own rule and tail formula differ by one matching bit, so pick one and
use it consistently [arxiv:2303.15435 §3.1].

## Contradictions

- **Abstract versus body on crops.** The abstract reports over 90% accuracy
  for a 10% crop at FPR below 1e-6, but the body does not state that figure
  directly and points to its detection plot [arxiv:2303.15435 abstract]
  [arxiv:2303.15435 §5.1].
- **Quality weight versus robustness.** Higher λ_i keeps images closer to the
  original decoder but lowers bit accuracy under the combined edit
  [arxiv:2303.15435 §6.5]. The default λ_i = 2.0 lies outside the swept range,
  so the quality and robustness numbers in the main table do not state which
  weight produced them [arxiv:2303.15435 §4.2] [arxiv:2303.15435 tab. 1]
  [arxiv:2303.15435 tab. 3].
- **Extractor bit independence.** The false-positive rate assumes independent
  bits. The paper says the whitened extractor is close to that, and that its
  empirical rate is slightly higher below 1e-6, which is conservative
  [arxiv:2303.15435 app. B.5] [arxiv:2303.15435 app. B.6]. For the comparison
  baseline, the authors say HiDDeN's bits are not independent, so its
  guarantees do not hold [arxiv:2303.15435 §6.4].

## Papers

- [The Stable Signature: Rooting Watermarks in Latent Diffusion Models](/papers/2303.15435): in-generation watermarking by fine-tuning the latent diffusion decoder, with per-user identification and a binomial test.