Image Watermarking of Generative Diffusion Models

TL;DR

This paper tackles copyright protection for diffusion-generated content by embedding watermarks directly into the diffusion generation process. It introduces a Watermark Autoencoder and a Watermark Extractor to enable end-to-end embedding and recovery of imperceptible watermark features, with a differentiable framework that blends watermark loss with standard diffusion loss. A Generative Watermarked Image (GWI) dataset is presented to benchmark watermark presence, reconstruction, and model-source classification across DDIM and DDPM architectures. Experimental results show that image quality remains high while watermarks are robust to common attacks, enabling reliable ownership verification and model attribution for diffusion-based content.

Abstract

Embedding watermarks into the output of generative models is essential for establishing copyright and verifiable ownership over the generated content. Emerging diffusion model watermarking methods either embed watermarks in the frequency domain or offer limited versatility of the watermark patterns in the image space, which allows simplistic detection and removal of the watermarks from the generated content. To address this issue, we propose a watermarking technique that embeds watermark features into the diffusion model itself. Our technique enables training of a paired watermark extractor for a generative model that is learned through an end-to-end process. The extractor forces the generator, during training, to effectively embed versatile, imperceptible watermarks in the generated content while simultaneously ensuring their precise recovery. We demonstrate highly accurate watermark embedding/detection and show that it is also possible to distinguish between different watermarks embedded with our method to differentiate between generative models.

Figures (8)

• Figure 1: During our model training phase, feature maps extracted from a watermark image are combined with a Gaussian sample to train the diffusion model. Generated images obtained from reverse diffusion process contain watermark features. The Watermark Extractor extracts the watermark features from the image to reconstruct the watermark.
• Figure 2: The Watermark Generator transforms an image-based watermark $w$ into a watermark feature map $w_{T}$ which serves as a branch input to the diffusion model. It is merged with the output $x_{T}$ of the forward diffusion process. The watermarked noise '$xw_T$' serves as a new input for the diffusion denoising phase, which enables embedding watermark features into the diffusion model. The trained diffusion model generates images $xw_{0}$ as usual, but they contain imperceptible watermark information. The Watermark Extractor learns to reconstruct the watermark $w_R$ from the generated images.
• Figure 3: Our blind watermarking mechanism is incorporated into DDIM and DDPM, generating images with two unique watermarks per model. Each model was trained and analyzed at three different resolutions, with the watermarks also adjusted to the corresponding resolutions for training.
• Figure 4: The Classification Process for Watermark Detection and Identification. The input first passes through a Binary classification network to determine whether it contains a blind watermark. It then goes through a Quaternary classification network to identify the type of watermark. The two classification networks differ only in the final softmax layer.
• Figure 5: Loss analysis of the end-to-end training process. The Y-axis represents the change in loss, while the X-axis represents the increase in epochs. The figure illustrates the loss curves for the diffusion model $L_{\text{D}}$ and autoencoder $L_{\text{W}}$. We asses our performances across three image resolutions. We can observe that $L_{\text{D}}$ (blue curve) converges rapidly and soon levels with $L_{\text{W}}$ (yellow curve).