SWA-LDM: Toward Stealthy Watermarks for Latent Diffusion Models

TL;DR

This paper tackles the risk of easily detectable watermark signals in latent-based diffusion watermarking by revealing a watermark presence attack that exploits constant signals across outputs. It proposes SWA-LDM, a plug-and-play mechanism that derives a per-image key from latent noise $z_T$ to randomize watermark embedding, producing image-dependent watermarks without additional nonce management. Empirical results show SWA-LDM substantially improves watermark stealthiness while maintaining competitive robustness and image fidelity across multiple base models and watermarking baselines. The approach offers a practical pathway to strengthen copyright protection and content integrity for LDM-generated images in real-world deployment.

Abstract

In the rapidly evolving landscape of image generation, Latent Diffusion Models (LDMs) have emerged as powerful tools, enabling the creation of highly realistic images. However, this advancement raises significant concerns regarding copyright infringement and the potential misuse of generated content. Current watermarking techniques employed in LDMs often embed constant signals to the generated images that compromise their stealthiness, making them vulnerable to detection by malicious attackers. In this paper, we introduce SWA-LDM, a novel approach that enhances watermarking by randomizing the embedding process, effectively eliminating detectable patterns while preserving image quality and robustness. Our proposed watermark presence attack reveals the inherent vulnerabilities of existing latent-based watermarking methods, demonstrating how easily these can be exposed. Through comprehensive experiments, we validate that SWA-LDM not only fortifies watermark stealthiness but also maintains competitive performance in watermark robustness and visual fidelity. This work represents a pivotal step towards securing LDM-generated images against unauthorized use, ensuring both copyright protection and content integrity in an era where digital image authenticity is paramount.

Figures (5)

• Figure 1: The general framework of the latent-based watermarking method for LDMs. They often add the same watermark signal to different generated images, which attackers can exploit to detect the presence of watermark.
• Figure 2: The overview of watermark presence attack.
• Figure 3: The framework of SWA-LDM. We extract the key $\mathbf{k}$ from randomly initialized latent variables and use it to shuffle the remaining latent variables where the watermark is inserted. This ensures the watermark information is randomized in each generated image.
• Figure 4: Performance of SWA-LDM with varying numbers of redundancies. The effectiveness is demonstrated through AUC and stealthiness metrics, where (a) compares SWA-LDM(G-S) with Gaussian Shading and (b) compares SWA-LDM(T-R) with Tree-Ring. (c) compares SWA-LDM(D-T) with DiffuseTrace.
• Figure 5: Performance of SWA-LDM with varying bit number of key. The effectiveness is demonstrated through AUC and stealthiness metrics, where (a) compares SWA-LDM(G-S) with Gaussian Shading and (b) compares SWA-LDM(T-R) with Tree-Ring. (c) compares SWA-LDM(D-T) with DiffuseTrace.