RingID: Rethinking Tree-Ring Watermarking for Enhanced Multi-Key Identification

TL;DR

This work analyzes Tree-Ring watermarking in diffusion models, revealing that an unintentional distribution shift from imprinting substantially boosts verification robustness but does not support multi-key identification. Building on this insight, the authors propose RingID, a Multi-Channel Heterogeneous Watermarking framework combining a ring-pattern with a Gaussian watermark across channels, plus discretization and lossless imprinting to enhance identification capacity and rotation robustness. RingID achieves dramatic improvements in identification accuracy (e.g., from 0.07 to 0.82) and verification AUC (0.975 to 0.995), while maintaining generation quality, and demonstrates scalability to large key sets. The paper also discusses practical design choices, such as keeping rings in a single channel for capacity and introducing rotation-invariant techniques, and acknowledges limitations under cropping and scaling attacks, pointing to future work in robust transform-domain defenses.

Abstract

We revisit Tree-Ring Watermarking, a recent diffusion model watermarking method that demonstrates great robustness to various attacks. We conduct an in-depth study on it and reveal that the distribution shift unintentionally introduced by the watermarking process, apart from watermark pattern matching, contributes to its exceptional robustness. Our investigation further exposes inherent flaws in its original design, particularly in its ability to identify multiple distinct keys, where distribution shift offers no assistance. Based on these findings and analysis, we present RingID for enhanced multi-key identification. It consists of a novel multi-channel heterogeneous watermarking approach designed to seamlessly amalgamate distinctive advantages from diverse watermarks. Coupled with a series of suggested enhancements, RingID exhibits substantial advancements in multi-key identification. Github Page: https://github.com/showlab/RingID

Figures (9)

• Figure 1: Tree-Ring imprints a broken watermark to a single channel. Our method RingID achieves stronger robustness by imprinting intact watermarks to multiple channels. In the task of multi-key identification, RingID shows overwhelming advantages.
• Figure 2: Framework of the watermarking process. RingID introduces a series of approaches that can help to imprint a lossless and robust watermark. In contrast, Tree-Ring injects a lossy and less robust watermark.
• Figure 3: The effect of distribution shift in both verification and identification tasks. Discarding the imaginary part during watermark imprinting causes the distribution shift in $\ell_1$ distance. Distribution shift aids verification but not identification.
• Figure 4: Detailed illustration of different acts and their impacts. (a) Discretization: Discretize values to $\pm \alpha$ for each ring, increasing the distinguishing ability of the watermark. (b) Rounder ring: Render smoother edges and reduce artifacts. Increase rotational robustness. (c) Spatial Shift: Shift energy on the corners to the center, avoiding potential cropping during rotation. (d) Lossless Imprinting: Ensure the imprinted pattern the same as the original design. (e) Crop & Scale: Zooming in the spatial domain compresses the imprinted pattern in the frequency domain, causing pattern mismatch and hinders identification.
• Figure 5: Distributing 12 rings across different number of channels (#CHs). This table reports the average identification accuracy and CLIP Score.