Radioactive Watermarks in Diffusion and Autoregressive Image Generative Models

TL;DR

This paper investigates the persistence of watermarks in images generated by diffusion and autoregressive models, revealing limitations in existing methods and proposing a novel watermarking technique for autoregressive models to enable reliable image provenance tracking.

Contribution

The paper analyzes watermark radioactivity in diffusion models, identifies their limitations, and introduces the first watermarking method for autoregressive models that preserves radioactivity.

Findings

Existing watermarking methods fail to retain radioactivity in diffusion models.

The proposed method effectively preserves watermarks in autoregressive models.

Watermarking enables robust provenance tracking and prevents unauthorized use.

Abstract

Image generative models have become increasingly popular, but training them requires large datasets that are costly to collect and curate. To circumvent these costs, some parties may exploit existing models by using the generated images as training data for their own models. In general, watermarking is a valuable tool for detecting unauthorized use of generated images. However, when these images are used to train a new model, watermarking can only enable detection if the watermark persists through training and remains identifiable in the outputs of the newly trained model - a property known as radioactivity. We analyze the radioactivity of watermarks in images generated by diffusion models (DMs) and image autoregressive models (IARs). We find that existing watermarking methods for DMs fail to retain radioactivity, as watermarks are either erased during encoding into the latent space or lost in the noising-denoising process (during the training in the latent space). Meanwhile, despite IARs having recently surpassed DMs in image generation quality and efficiency, no radioactive watermarking methods have been proposed for them. To overcome this limitation, we propose the first watermarking method tailored for IARs and with radioactivity in mind - drawing inspiration from techniques in large language models (LLMs), which share IARs' autoregressive paradigm. Our extensive experimental evaluation highlights our method's effectiveness in preserving radioactivity within IARs, enabling robust provenance tracking, and preventing unauthorized use of their generated images.