Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Detection Limits and Statistical Separability of Tree Ring Watermarks in Rectified Flow-based Text-to-Image Generation Models

Ved Umrajkar, Aakash Kumar Singh

TL;DR

This work investigates Tree-Ring Watermarking in rectified-flow text-to-image models, focusing on FLUX versus SD 2.1. It analyzes watermark reconstruction via noise-latent inversion and evaluates separability between watermarked and non-watermarked images under various prompts and attacks. The study finds that FLUX's invertibility and watermark detection are highly sensitive to prompt guidance and attack conditions, while diffusion-based SD models maintain more robust separability. The results underscore the need for improved inversion techniques tailored to flow-based architectures and more robust watermarking strategies for real-world deployment.

Abstract

Tree-Ring Watermarking is a significant technique for authenticating AI-generated images. However, its effectiveness in rectified flow-based models remains unexplored, particularly given the inherent challenges of these models with noise latent inversion. Through extensive experimentation, we evaluated and compared the detection and separability of watermarks between SD 2.1 and FLUX.1-dev models. By analyzing various text guidance configurations and augmentation attacks, we demonstrate how inversion limitations affect both watermark recovery and the statistical separation between watermarked and unwatermarked images. Our findings provide valuable insights into the current limitations of Tree-Ring Watermarking in the current SOTA models and highlight the critical need for improved inversion methods to achieve reliable watermark detection and separability. The official implementation, dataset release and all experimental results are available at this \href{https://github.com/dsgiitr/flux-watermarking}{\textbf{link}}.

Detection Limits and Statistical Separability of Tree Ring Watermarks in Rectified Flow-based Text-to-Image Generation Models

TL;DR

This work investigates Tree-Ring Watermarking in rectified-flow text-to-image models, focusing on FLUX versus SD 2.1. It analyzes watermark reconstruction via noise-latent inversion and evaluates separability between watermarked and non-watermarked images under various prompts and attacks. The study finds that FLUX's invertibility and watermark detection are highly sensitive to prompt guidance and attack conditions, while diffusion-based SD models maintain more robust separability. The results underscore the need for improved inversion techniques tailored to flow-based architectures and more robust watermarking strategies for real-world deployment.

Abstract

Tree-Ring Watermarking is a significant technique for authenticating AI-generated images. However, its effectiveness in rectified flow-based models remains unexplored, particularly given the inherent challenges of these models with noise latent inversion. Through extensive experimentation, we evaluated and compared the detection and separability of watermarks between SD 2.1 and FLUX.1-dev models. By analyzing various text guidance configurations and augmentation attacks, we demonstrate how inversion limitations affect both watermark recovery and the statistical separation between watermarked and unwatermarked images. Our findings provide valuable insights into the current limitations of Tree-Ring Watermarking in the current SOTA models and highlight the critical need for improved inversion methods to achieve reliable watermark detection and separability. The official implementation, dataset release and all experimental results are available at this \href{https://github.com/dsgiitr/flux-watermarking}{\textbf{link}}.

Paper Structure

This paper contains 31 sections, 20 equations, 4 figures, 4 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related Works
  3. Watermarking Approaches.
  4. Inversion Methods.
  5. Methodology
  6. Preliminaries
  7. Notation
  8. Generation and Inversion Framework
  9. FLUX
  10. Approach
  11. Tree-Ring Watermark Embedding
  12. VLM Generated Prompt for Inversion Guidance
  13. Evaluation
  14. Experiments
  15. Experimental Setup
  16. ...and 16 more sections

Figures (4)

  • Figure 1: Watermarking workflow for both FLUX and Stable Diffusion
  • Figure 2: Distribution of watermark distances in Fourier space. Attacked scenarios show the distribution of the fourier space distance under noise, and blur manipulations. It can be clearly seen that in non-attacked scenarios, the prompt guidance plays a significant role in accurate inversion. We note that in attack scenarios the distance in the fourier space is drastically increased for FLUX.1-dev.
  • Figure 3: Visualization of noise reconstruction in spatial and frequency domains. Left: Channel 0 of the latent noise in spatial domain averaged over 100 samples, showing the characteristic noise pattern. Center: Magnitude of the 2D Fourier transform of Channel 0, revealing the circular watermark pattern in frequency space. Right: Original noise, reconstructed noise, and their difference (error magnified by 1×) for a representative sample, with NMSE of 0.01161.
  • Figure 4: Image generation results from the reconstructed initial noise using FLUX.1-dev. Despite using identical prompts, notable differences can be observed between original generations (left) and those from reconstructed noise (right).