Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Spread them Apart: Towards Robust Watermarking of Generated Content

Mikhail Pautov, Danil Ivanov, Andrey V. Galichin, Oleg Rogov, Ivan Oseledets

TL;DR

The paper addresses the challenge of identifying the provenance and ownership of content produced by powerful diffusion-based generators. It introduces Spread them Apart, a watermarking scheme embedded during inference that assigns each user a binary watermark and a secret, enabling simultaneous detection and attribution with a provable robustness guarantee against bounded additive perturbations. The method optimizes a pixel-pair constraint loss in the latent space to embed watermarks while preserving image quality, and provides theoretical bounds showing that erasing bits requires perturbations above certain magnitudes. Empirically, it achieves competitive image quality and strong watermark robustness against common post-processing attacks, and proposes an extension to defend against geometric transformations by embedding multiple watermarks in pixel and invariant domains. The work offers a practical, non-intrusive approach to protecting generated content and user accountability, with clear avenues for handling more transformations through invariants in future work.

Abstract

Generative models that can produce realistic images have improved significantly in recent years. The quality of the generated content has increased drastically, so sometimes it is very difficult to distinguish between the real images and the generated ones. Such an improvement comes at a price of ethical concerns about the usage of the generative models: the users of generative models can improperly claim ownership of the generated content protected by a license. In this paper, we propose an approach to embed watermarks into the generated content to allow future detection of the generated content and identification of the user who generated it. The watermark is embedded during the inference of the model, so the proposed approach does not require the retraining of the latter. We prove that watermarks embedded are guaranteed to be robust against additive perturbations of a bounded magnitude. We apply our method to watermark diffusion models and show that it matches state-of-the-art watermarking schemes in terms of robustness to different types of synthetic watermark removal attacks.

Spread them Apart: Towards Robust Watermarking of Generated Content

TL;DR

The paper addresses the challenge of identifying the provenance and ownership of content produced by powerful diffusion-based generators. It introduces Spread them Apart, a watermarking scheme embedded during inference that assigns each user a binary watermark and a secret, enabling simultaneous detection and attribution with a provable robustness guarantee against bounded additive perturbations. The method optimizes a pixel-pair constraint loss in the latent space to embed watermarks while preserving image quality, and provides theoretical bounds showing that erasing bits requires perturbations above certain magnitudes. Empirically, it achieves competitive image quality and strong watermark robustness against common post-processing attacks, and proposes an extension to defend against geometric transformations by embedding multiple watermarks in pixel and invariant domains. The work offers a practical, non-intrusive approach to protecting generated content and user accountability, with clear avenues for handling more transformations through invariants in future work.

Abstract

Generative models that can produce realistic images have improved significantly in recent years. The quality of the generated content has increased drastically, so sometimes it is very difficult to distinguish between the real images and the generated ones. Such an improvement comes at a price of ethical concerns about the usage of the generative models: the users of generative models can improperly claim ownership of the generated content protected by a license. In this paper, we propose an approach to embed watermarks into the generated content to allow future detection of the generated content and identification of the user who generated it. The watermark is embedded during the inference of the model, so the proposed approach does not require the retraining of the latter. We prove that watermarks embedded are guaranteed to be robust against additive perturbations of a bounded magnitude. We apply our method to watermark diffusion models and show that it matches state-of-the-art watermarking schemes in terms of robustness to different types of synthetic watermark removal attacks.

Paper Structure

This paper contains 25 sections, 3 theorems, 26 equations, 2 figures, 6 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Diffusion Model
  4. Watermarking of Digital Content
  5. Robustness to Watermark Removal Attacks
  6. Problem Statement
  7. Image Watermarking
  8. The Probability of Incorrect Attribution
  9. Robustness to Watermark Removal Attacks
  10. Method
  11. Embedding and Extraction of the Watermark
  12. Implementation Details
  13. Robustness Guarantee
  14. Experiments
  15. General Setup
  16. ...and 10 more sections

Key Result

Lemma 4.1

Let $\varepsilon \in \mathbb{R}^d$ and $\Delta_{i_1} \le \Delta_{i_2} \le \dots \le \Delta_{i_n}$. Then, if $\|\varepsilon\|_\infty < \Delta_{i_k}$, then $d(w(u_i|x + \varepsilon), w(u_i|x)) < k.$

Figures (2)

  • Figure 1: Illustration of the proposed method. During the image generation phase, the user $u_i$ queries the model with the prompt. Given the prompt, the model produces the latent $z$, from which the image is generated. If the image generated satisfies the constraint $\mathcal{L}_{wm} < \varepsilon$ (meaning the watermark is successfully embedded), it is yielded to the user; otherwise, the loss function from Eq. \ref{['eq:TotalLoss']} is minimized with respect to the latent $z$. Note that the value of $\varepsilon$ may vary from image to image. During the watermark retrieval phase, given the image $x$ and $m$ secrets, $s(u_1), \dots, s(u_m)$, the watermark decoder extracts m watermarks, $w(u_1|x), \dots, w(u_m|x)$. Then, the image is attributed to the user $u$ according to the Eq. \ref{['eq:attribution']}.
  • Figure 2: Examples of watermarked images. The maps of absolute pixel-wise difference between source images and the generated ones were added for illustrational purposes.

Theorems & Definitions (7)

  • Remark
  • Remark
  • Lemma 4.1
  • proof
  • Theorem A.1
  • Theorem A.2
  • Remark