Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

METR: Image Watermarking with Large Number of Unique Messages

Alexander Varlamov, Daria Diatlova, Egor Spirin

TL;DR

METR addresses the need for robust watermarking of diffusion-model outputs while supporting a large number of unique messages. It encodes binary messages into concentric circles in the Fourier domain of the initial diffusion noise, preserving image quality and resilience to white-box attacks; METR++ extends this approach to Latent Diffusion Models by combining METR with per-group Stable Signature decoders to dramatically increase capacity to $2^R$ per group and beyond. Compared to Tree-Ring, METR achieves superior detection robustness, including under diffusion and VAE attacks, with only minor degradation in image quality; METR++ further increases message capacity by leveraging grouped Stable Signature decoders. The methods are evaluated on Stable Diffusion 2.1 with MSCOCO-5000 prompts, and code is publicly available, enabling practical deployment for creator attribution and content provenance.

Abstract

Improvements in diffusion models have boosted the quality of image generation, which has led researchers, companies, and creators to focus on improving watermarking algorithms. This provision would make it possible to clearly identify the creators of generative art. The main challenges that modern watermarking algorithms face have to do with their ability to withstand attacks and encrypt many unique messages, such as user IDs. In this paper, we present METR: Message Enhanced Tree-Ring, which is an approach that aims to address these challenges. METR is built on the Tree-Ring watermarking algorithm, a technique that makes it possible to encode multiple distinct messages without compromising attack resilience or image quality. This ensures the suitability of this watermarking algorithm for any Diffusion Model. In order to surpass the limitations on the quantity of encoded messages, we propose METR++, an enhanced version of METR. This approach, while limited to the Latent Diffusion Model architecture, is designed to inject a virtually unlimited number of unique messages. We demonstrate its robustness to attacks and ability to encrypt many unique messages while preserving image quality, which makes METR and METR++ hold great potential for practical applications in real-world settings. Our code is available at https://github.com/deepvk/metr

METR: Image Watermarking with Large Number of Unique Messages

TL;DR

METR addresses the need for robust watermarking of diffusion-model outputs while supporting a large number of unique messages. It encodes binary messages into concentric circles in the Fourier domain of the initial diffusion noise, preserving image quality and resilience to white-box attacks; METR++ extends this approach to Latent Diffusion Models by combining METR with per-group Stable Signature decoders to dramatically increase capacity to per group and beyond. Compared to Tree-Ring, METR achieves superior detection robustness, including under diffusion and VAE attacks, with only minor degradation in image quality; METR++ further increases message capacity by leveraging grouped Stable Signature decoders. The methods are evaluated on Stable Diffusion 2.1 with MSCOCO-5000 prompts, and code is publicly available, enabling practical deployment for creator attribution and content provenance.

Abstract

Improvements in diffusion models have boosted the quality of image generation, which has led researchers, companies, and creators to focus on improving watermarking algorithms. This provision would make it possible to clearly identify the creators of generative art. The main challenges that modern watermarking algorithms face have to do with their ability to withstand attacks and encrypt many unique messages, such as user IDs. In this paper, we present METR: Message Enhanced Tree-Ring, which is an approach that aims to address these challenges. METR is built on the Tree-Ring watermarking algorithm, a technique that makes it possible to encode multiple distinct messages without compromising attack resilience or image quality. This ensures the suitability of this watermarking algorithm for any Diffusion Model. In order to surpass the limitations on the quantity of encoded messages, we propose METR++, an enhanced version of METR. This approach, while limited to the Latent Diffusion Model architecture, is designed to inject a virtually unlimited number of unique messages. We demonstrate its robustness to attacks and ability to encrypt many unique messages while preserving image quality, which makes METR and METR++ hold great potential for practical applications in real-world settings. Our code is available at https://github.com/deepvk/metr
Paper Structure (16 sections, 2 equations, 10 figures, 4 tables, 3 algorithms)

This paper contains 16 sections, 2 equations, 10 figures, 4 tables, 3 algorithms.

Table of Contents

  1. Introduction
  2. Related Works
  3. Diffusion Process
  4. Tree-Ring Watermark
  5. Latent Diffusion and Stable Signature
  6. Watermark Attacks
  7. Methods
  8. METR
  9. Detection Resolution Metric
  10. METR++
  11. Experiments
  12. Experimental Setup
  13. METR Evaluation
  14. METR++ Evaluation
  15. Future Work
  16. ...and 1 more sections

Figures (10)

  • Figure 1: METR watermarking pipeline. Figure (a) outlines the steps to encrypt a binary message into an image via corresponding latent noise. Figure (b) details the process of detecting whether an image contains a watermark and deciphering the encrypted message.
  • Figure 2: Stable-Signature fernandez2023stable scheme. Algorithms for watermark extraction and VAE decoder fine-tuning.
  • Figure 3: Message becomes circles in Fourier space $\mathcal{F}$ of the latent noise $\mathbf{x}_T$
  • Figure 4: Original image and the corresponding one with a METR watermark, generated with a fixed scale $S$, but with different radii $r$.
  • Figure 5: Original image and the corresponding one with a METR watermark, generated with fixed radius $r$, but with different scales $S$.
  • ...and 5 more figures