Dual-Guard: Dual-Channel Latent Watermarking for Provenance and Tamper Localization in Diffusion Images

TL;DR

Dual-Guard introduces a dual-channel latent watermarking framework for diffusion images that enhances provenance verification, resists framing, and localizes tampered regions effectively.

Contribution

It combines a global provenance watermark and a structured content anchor to improve tamper detection and localization in diffusion-generated images.

Findings

Achieves less than 0.5% false rejection and false alarm rates on clean images.

Maintains near-complete detection under various attacks including reprompting and editing.

Effective in localizing tampered regions with high accuracy.

Abstract

The rapid adoption of diffusion-based generative models has intensified concerns over the attribution and integrity of AI-generated content (AIGC). Existing single-domain watermarking methods either fail under regeneration, remain vulnerable to black-box reprompting that enables adversarial framing, or provide no spatial evidence for tampered regions. We propose Dual-Guard, a dual-channel latent watermarking framework for practical provenance verification, framing resistance, and region-level tamper localization. Dual-Guard combines two complementary anchors: a Gaussian Shading watermark in the initial diffusion noise as a global provenance signal, and a Latent Fingerprint Codec in the final denoised latent as a structured content anchor. Reprompting tends to preserve the former while breaking the latter, whereas localized edits disturb the content anchor only in tampered regions. In Full mode on a 2,400-sample benchmark, Dual-Guard keeps clean-image authentication false rejection and tamper false alarm below one half of one percent, while maintaining near-complete detection under reprompting, diffusion editing, and eight local tampering attacks.