Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Latent Watermark: Inject and Detect Watermarks in Latent Diffusion Space

Zheling Meng, Bo Peng, Jing Dong

TL;DR

This paper highlights that an effective solution to the problem is to both inject and detect watermarks in the latent diffusion space, and proposes Latent Watermark with a progressive training strategy that weakens the direct connection between quality and robustness and thus alleviates their contradiction.

Abstract

Watermarking is a tool for actively identifying and attributing the images generated by latent diffusion models. Existing methods face the dilemma of image quality and watermark robustness. Watermarks with superior image quality usually have inferior robustness against attacks such as blurring and JPEG compression, while watermarks with superior robustness usually significantly damage image quality. This dilemma stems from the traditional paradigm where watermarks are injected and detected in pixel space, relying on pixel perturbation for watermark detection and resilience against attacks. In this paper, we highlight that an effective solution to the problem is to both inject and detect watermarks in the latent diffusion space, and propose Latent Watermark with a progressive training strategy. It weakens the direct connection between quality and robustness and thus alleviates their contradiction. We conduct evaluations on two datasets and against 10 watermark attacks. Six metrics measure the image quality and watermark robustness. Results show that compared to the recently proposed methods such as StableSignature, StegaStamp, RoSteALS, LaWa, TreeRing, and DiffuseTrace, LW not only surpasses them in terms of robustness but also offers superior image quality. Our code will be available at https://github.com/RichardSunnyMeng/LatentWatermark.

Latent Watermark: Inject and Detect Watermarks in Latent Diffusion Space

TL;DR

This paper highlights that an effective solution to the problem is to both inject and detect watermarks in the latent diffusion space, and proposes Latent Watermark with a progressive training strategy that weakens the direct connection between quality and robustness and thus alleviates their contradiction.

Abstract

Watermarking is a tool for actively identifying and attributing the images generated by latent diffusion models. Existing methods face the dilemma of image quality and watermark robustness. Watermarks with superior image quality usually have inferior robustness against attacks such as blurring and JPEG compression, while watermarks with superior robustness usually significantly damage image quality. This dilemma stems from the traditional paradigm where watermarks are injected and detected in pixel space, relying on pixel perturbation for watermark detection and resilience against attacks. In this paper, we highlight that an effective solution to the problem is to both inject and detect watermarks in the latent diffusion space, and propose Latent Watermark with a progressive training strategy. It weakens the direct connection between quality and robustness and thus alleviates their contradiction. We conduct evaluations on two datasets and against 10 watermark attacks. Six metrics measure the image quality and watermark robustness. Results show that compared to the recently proposed methods such as StableSignature, StegaStamp, RoSteALS, LaWa, TreeRing, and DiffuseTrace, LW not only surpasses them in terms of robustness but also offers superior image quality. Our code will be available at https://github.com/RichardSunnyMeng/LatentWatermark.
Paper Structure (30 sections, 10 equations, 12 figures, 7 tables)

This paper contains 30 sections, 10 equations, 12 figures, 7 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Latent Diffusion Model
  4. Watermarks for Latent Diffusion Models
  5. Watermark Attacks
  6. Methods
  7. Threat Model
  8. Latent Watermark
  9. Three-Step Progressive Training Strategy
  10. Experiments, Results and Discussions
  11. Experiment Setup
  12. Datasets
  13. Watermark Baselines
  14. LW Structure
  15. LW Training
  16. ...and 15 more sections

Figures (12)

  • Figure 1: The overall performance of image quality and watermark robustness on the MS-COCO 2017 evaluation lin2014coco for StableSignature (S.Signa., 48 bits) fernandez2023stable, StegaStamp (S.Stamp, 56 bits) tancik2020stegastamp, RoSteALS (56 bits) bui2023rosteals, LaWa (48 bits) rezaei2024lawa, TreeRing wen2023tree, DiffuseTrace (56 bits) lei2024diffusetrace, as well as our proposed Latent Watermark (48 bits, 56 bits, and 64 bits). Please see Sec.\ref{['sec:setup']} for more details about the overall performance calculation.
  • Figure 2: The threat model. The service provider generates an image according to the request of the user and watermarks it. The regulator detects the watermark of the damaged image for the identification and attribution task.
  • Figure 3: The proposed methods. (a) The structure of LW. (b) The three-step progressive training strategy. $M$: $n$-bit messages. $z_{(l)}$: $l$-th channel of latent image $z$.
  • Figure 4: The clean images and the images watermarked by StegaStamp tancik2020stegastamp (56 bits), RoSteALS bui2023rosteals (56 bits), and LW (56 bits). The residual images between the watermarked images and the clean images are given, with the mean absolute pixel difference in the upper right corner.
  • Figure 5: The radar chart for a comprehensive evaluation. The metrics are unified and transformed using the method mentioned in Sec.\ref{['sec:setup']}.
  • ...and 7 more figures