SLICE: Semantic Latent Injection via Compartmentalized Embedding for Image Watermarking

TL;DR

SLICE introduces a compartmentalized embedding framework that decouples image semantics into four factors, enabling precise, region-specific watermarking for robust image provenance verification and tamper localization against sophisticated attacks.

Contribution

The paper proposes SLICE, a novel semantic latent injection method that decouples semantics into four factors and anchors them to specific regions, enhancing robustness and tamper detection in image watermarking.

Findings

Outperforms existing methods against semantic-guided regeneration attacks

Reduces attack success rate significantly while maintaining image quality

Provides statistical guarantees on false-accept rates

Abstract

Watermarking the initial noise of diffusion models has emerged as a promising approach for image provenance, but content-independent noise patterns can be forged via inversion and regeneration attacks. Recent semantic-aware watermarking methods improve robustness by conditioning verification on image semantics. However, their reliance on a single global semantic binding makes them vulnerable to localized but globally coherent semantic edits. To address this limitation and provide a trustworthy semantic-aware watermark, we propose $\underline{\textbf{S}}$emantic $\underline{\textbf{L}}$atent $\underline{\textbf{I}}$njection via $\underline{\textbf{C}}$ompartmentalized $\underline{\textbf{E}}$mbedding ($\textbf{SLICE}$). Our framework decouples image semantics into four semantic factors (subject, environment, action, and detail) and precisely anchors them to distinct regions in the initial Gaussian noise. This fine-grained semantic binding enables advanced watermark verification where semantic tampering is detectable and localizable. We theoretically justify why SLICE enables robust and reliable tamper localization and provides statistical guarantees on false-accept rates. Experimental results demonstrate that SLICE significantly outperforms existing baselines against advanced semantic-guided regeneration attacks, substantially reducing attack success while preserving image quality and semantic fidelity. Overall, SLICE offers a practical, training-free provenance solution that is both fine-grained in diagnosis and robust to realistic adversarial manipulations.