Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models

TL;DR

Gaussian Shading tackles copyright protection in diffusion-model outputs by embedding a watermark directly in latent space without training or parameter modification. By mapping the watermark to a standard Gaussian latent and enforcing distribution-preserving sampling, it achieves a true lossless watermarking regime that remains robust under lossy edits and supports 256-bit capacity. The watermark can be extracted via DDIM inversion, enabling both detection and traceability with minimal impact on visual quality or semantic fidelity. Empirical results across multiple Stable Diffusion versions show superior detection and traceability performance compared to baselines, supported by a formal losslessness argument and extensive robustness evaluations.

Abstract

Ethical concerns surrounding copyright protection and inappropriate content generation pose challenges for the practical implementation of diffusion models. One effective solution involves watermarking the generated images. However, existing methods often compromise the model performance or require additional training, which is undesirable for operators and users. To address this issue, we propose Gaussian Shading, a diffusion model watermarking technique that is both performance-lossless and training-free, while serving the dual purpose of copyright protection and tracing of offending content. Our watermark embedding is free of model parameter modifications and thus is plug-and-play. We map the watermark to latent representations following a standard Gaussian distribution, which is indistinguishable from latent representations obtained from the non-watermarked diffusion model. Therefore we can achieve watermark embedding with lossless performance, for which we also provide theoretical proof. Furthermore, since the watermark is intricately linked with image semantics, it exhibits resilience to lossy processing and erasure attempts. The watermark can be extracted by Denoising Diffusion Implicit Models (DDIM) inversion and inverse sampling. We evaluate Gaussian Shading on multiple versions of Stable Diffusion, and the results demonstrate that Gaussian Shading not only is performance-lossless but also outperforms existing methods in terms of robustness.

Figures (11)

• Figure 1: Existing watermarking frameworks can be divided into three categories: post-processing-based, fine-tuning-based, and latent-representation-based Tree-Ring. Our method also relies on latent representations but achieves performance-lossless without altering the distribution.
• Figure 2: Application scenarios for Gaussian Shading.
• Figure 3: The framework of Gaussian Shading. We utilize a $k$-bit binary sequence $s$ to represent the watermark. After diffusion and encryption, the watermark can be utilized to drive distribution-preserving sampling, followed by denoising to generate watermarked images $X^s$. For extraction, it is sufficient to introduce DDIM inversion and the inverse process of all the operations mentioned above.
• Figure 4: Watermarked image is attacked by different noise. (a) Watermarked image. (b) JPEG, $QF=25$. (c) 60% area Random Crop (RandCr). (d) 80% area Random Drop (RandDr). (e) Gaussian Blur, $r=4$ (GauBlur). (f) Median Filter, $k=7$ (MedFilter). (g) Gaussian Noise, $\mu= 0$, $\sigma = 0.05$ (GauNoise). (h) Salt and Pepper Noise, $p = 0.05$ (S&PNoise). (i) 25% Resize and restore (Resize). (j) Brightness, $factor=6$.
• Figure 5: Performance of Gaussian Shading.