ClusterMark: Towards Robust Watermarking for Autoregressive Image Generators with Visual Token Clustering

TL;DR

This paper introduces ClusterMark, a robust watermarking method for autoregressive image models using visual token clustering, enhancing robustness against perturbations and attacks while maintaining image quality.

Contribution

Proposes a novel token clustering-based watermarking scheme for autoregressive image models, improving robustness and verification speed compared to existing methods.

Findings

ClusterMark significantly outperforms baselines in robustness against perturbations.

Token clustering maintains high image quality and fast verification.

Method is effective in both training-free and fine-tuned settings.

Abstract

In-generation watermarking for latent diffusion models has recently shown high robustness in marking generated images for easier detection and attribution. However, its application to autoregressive (AR) image models is underexplored. Autoregressive models generate images by autoregressively predicting a sequence of visual tokens that are then decoded into pixels using a VQ-VAE decoder. Inspired by KGW watermarking for large language models, we examine token-level watermarking schemes that bias the next-token prediction based on prior tokens. We find that a direct transfer of these schemes works in principle, but the detectability of the watermarks decreases considerably under common image perturbations. As a remedy, we propose a watermarking approach based on visual token clustering, which assigns similar tokens to the same set (red or green). We investigate token clustering in a training-free setting, as well as in combination with a more accurate fine-tuned token or cluster predictor. Overall, our experiments show that cluster-based watermarks greatly improve robustness against perturbations and regeneration attacks while preserving image quality, outperforming a set of baselines and concurrent works. Moreover, our methods offer fast verification runtime, comparable to lightweight post-hoc watermarking techniques.