Spread them Apart: Towards Robust Watermarking of Generated Content
Mikhail Pautov, Danil Ivanov, Andrey V. Galichin, Oleg Rogov, Ivan Oseledets
TL;DR
This paper introduces a method for embedding robust watermarks into generated images from diffusion models, enabling detection and user identification without retraining, and demonstrating robustness against various attacks.
Contribution
It presents a watermarking approach that is embedded during inference, ensuring robustness and compatibility with existing generative models without retraining.
Findings
Watermarks are robust against additive perturbations.
Method matches state-of-the-art robustness to removal attacks.
Watermarks enable content detection and user identification.
Abstract
Generative models that can produce realistic images have improved significantly in recent years. The quality of the generated content has increased drastically, so sometimes it is very difficult to distinguish between the real images and the generated ones. Such an improvement comes at a price of ethical concerns about the usage of the generative models: the users of generative models can improperly claim ownership of the generated content protected by a license. In this paper, we propose an approach to embed watermarks into the generated content to allow future detection of the generated content and identification of the user who generated it. The watermark is embedded during the inference of the model, so the proposed approach does not require the retraining of the latter. We prove that watermarks embedded are guaranteed to be robust against additive perturbations of a bounded…
Peer Reviews
Decision·ICLR 2025 Conference Withdrawn Submission
1. The proposed watermarking method is shown to be robust against various types of removal attacks, by conducting comprehensive experiments. 2. The bound of the robustness against additive watermark removal attacks is theoretically analyzed. 3. The paper is well-written overall.
1. The paper does not provide the evaluation of robustness against cropping, rotation, and translation attacks. 2. The proposed method needs 700 iterations to optimize the latent representation before generating an image, slowing down the generation speed. 3. More relevant watermarking methods should be included for comparison, for example, AquaLoRA [1]. [1] Feng, Weitao, et al. "AquaLoRA: Toward White-box Protection for Customized Stable Diffusion Models via Watermark LoRA." arXiv preprint arX
This paper is well-written and easy to follow. Although the methodology itself is straightforward, it is proven to be effective and robust against simple image manipulation.
The approach presented in this paper is relatively straightforward, demonstrating theoretical robustness against perturbations such as brightness adjustment, contrast shifts, and additive noise. However, its limitations are also apparent. As the authors acknowledge, the method lacks resilience against geometric distortions, which alter the image's size and indexing—common forms of attacks that the paper does not address in detail. While the authors suggest that "this limitation can be addressed
1. The watermarking method enables accurate identification of the user who sent the query, ensuring traceability. 2. The watermark minimally alters the image, maintaining high visual quality while embedding robust identifiers.
1. The robustness evaluation lacks common post-generation attacks like rotation, resizing, grayscale conversion, and cropping, and examples of corrupted images are not provided. 2. The watermark embedding process increases the image generation time. The paper should provide the experiments of generation time cost. 3. Experiments assessing the impact of watermarking on image quality are limited. More quantitive metrics like PSNR should be used
1. Compared with stable signature [1] and SSL [2], the method demonstrates strong robustness against attacks like brightness, contrast shift, gamma correction, sharpening, hue, satuation adjustment, noise attack, JPEG and PGD [3]. 2. The paper is well-written, and has a clear structure. [1] Fernandez, Pierre, et al. "The stable signature: Rooting watermarks in latent diffusion models." Proceedings of the IEEE/CVF International Conference on Computer Vision. 2023. [2] Fernandez, Pierre, et al.
1. The paper does not include ablation study, which is a large missing. For example, you could present the impact of different watermark length, the effect of epsilon parameter to the robustness nad visibility, the loss weight ($\lambda_{wm}$ and $\lambda_{qual}$) to the robustness and visibility. 2. The method embeds watermark in the pixel space. The latent vector $z$ is optimized during inference to constraint the loss within the acceptable region . It seems all models that have a decoder str
+ A method of embedding watermarks during the model inference phase is proposed to simultaneously detect and attribute generated images. + Proven robustness against bounded additive perturbations.
- The expression and logic of the paper can be further improved to enhance readability. For instance, a clear explanation of "$\mathcal{L_{qual}}$" is lacking. Additionally, there are a few typos, such as the use of "the" in line 115. - To enhance the understanding of the paper's innovation, the authors should compare their approach with using pixel differencing in digital watermarking [1]. By highlighting the differences between the two methods, the paper can further illustrate the unique con
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAdvanced Steganography and Watermarking Techniques · Video Analysis and Summarization · Internet Traffic Analysis and Secure E-voting