Shallow Diffuse: Robust and Invisible Watermarking through Low-Dimensional Subspaces in Diffusion Models

TL;DR

This work tackles the problem of watermarking diffusion-generated content in a way that works for both server-side generation and client-side post-processing. It introduces Shallow Diffuse, which embeds watermarks into a low-dimensional subspace by injecting at a carefully chosen timestep, leveraging the null-space of the Jacobian to preserve image quality while enabling reliable detection. The authors provide theoretical guarantees on watermark consistency and detectability and demonstrate strong empirical performance against baselines across multiple datasets, attacks, and model types, including T2I extensions and transformer-based diffusion. The approach is training-free, flexible, and practical for widespread deployment, offering a balanced solution between perceptual fidelity and robust attribution.

Abstract

The widespread use of AI-generated content from diffusion models has raised significant concerns regarding misinformation and copyright infringement. Watermarking is a crucial technique for identifying these AI-generated images and preventing their misuse. In this paper, we introduce Shallow Diffuse, a new watermarking technique that embeds robust and invisible watermarks into diffusion model outputs. Unlike existing approaches that integrate watermarking throughout the entire diffusion sampling process, Shallow Diffuse decouples these steps by leveraging the presence of a low-dimensional subspace in the image generation process. This method ensures that a substantial portion of the watermark lies in the null space of this subspace, effectively separating it from the image generation process. Our theoretical and empirical analyses show that this decoupling strategy greatly enhances the consistency of data generation and the detectability of the watermark. Extensive experiments further validate that our Shallow Diffuse outperforms existing watermarking methods in terms of robustness and consistency. The codes are released at https://github.com/liwd190019/Shallow-Diffuse.

Figures (7)

• Figure 1: Comparison between Tree-Ring Watermarks, RingID and Shallow Diffuse. (Top) On the left are the original images, and on the right are the corresponding watermarked images generated using three techniques: Tree-Ring wen2023tree, RingID ci2024ringid, and Shallow Diffuse. For each technique, we sampled watermarks using two distinct random seeds and obtained the respective watermarked images. (Bottom) Trade-off between consistency (measured by PSNR, SSIM, LPIPS) and robustness (measured by TPR@1%FPR) for Tree-Ring Watermarks, RingID, and Shallow Diffuse.
• Figure 2: Overview of Shallow Diffuse for T2I Diffusion Models. The server scenario (top left) illustrates watermark embedding during generation using CFG, while the user scenario (bottom left) demonstrates post-generation watermark embedding via DDIM inversion. In both scenarios, the watermark is applied within a low-dimensional subspace (top right), where most of the watermark resides in the null space of $\bm J_{\bm \theta, t}$ due to its low dimensionality. The adversarial detection (bottom right) highlights the watermark’s robustness, enabling the detector to retrieve the watermark even under adversarial attacks.
• Figure 3: Visualization of Watermark Patterns. The left two images show the circular mask $\bm M$ and the key within the mask $\bm M \odot \bm W$, where the key $\bm W$ consists of multiple rings and each sampled from the Gaussian distribution. The right two images illustrate the low- and high-frequency regions applying DFT, both before and after centering the zero frequency.
• Figure 4: Generation consistency under user scenarios. We compare the visualization quality of our method against DwtDct, DwtdctSvd, RivaGAN, Stegastamp, Stable Signature, Tree Ring, Gaussian Shading, and RingID across the DiffusionDB, and COCO datasets.
• Figure 5: Ablation study at different timestep $t$. We evaluate the consistency and robustness under user scenarios when watermarks are injected at varying timesteps.

Theorems & Definitions (10)

• Theorem 1: Consistency of the watermarks
• Theorem 2: Detectability of the watermark
• proof : Proof of \ref{['thm:consistency']}
• proof : Proof of \ref{['thm:detectability']}
• Lemma 1
• proof : Proof of \ref{['lemma:1']}
• Lemma 2
• proof : Proof of \ref{['lemma:2']}
• Lemma 3
• proof : Proof of \ref{['lemma:3']}