Autoregressive Images Watermarking through Lexical Biasing: An Approach Resistant to Regeneration Attack

TL;DR

Autoregressive image generators risk misuse; diffusion-watermarking does not transfer well to AR generation. The authors propose Lexical Bias Watermarking (LBW) to embed watermarks in AR token maps by biasing token selection toward green tokens, with hard/soft and post-hoc variants. A multi-green-list strategy strengthens resistance to white-box attacks, and detection uses a lightweight z-score test on token distributions after re-quantization. Experiments on VAR, VQ-GAN, and RAR show LBW achieves state-of-the-art robustness, particularly against regeneration attacks like CtrlRegen, while preserving image quality. This enables practical, robust watermarking for AR-based image synthesis and post-hoc watermarking.

Abstract

Autoregressive (AR) image generation models have gained increasing attention for their breakthroughs in synthesis quality, highlighting the need for robust watermarking to prevent misuse. However, existing in-generation watermarking techniques are primarily designed for diffusion models, where watermarks are embedded within diffusion latent states. This design poses significant challenges for direct adaptation to AR models, which generate images sequentially through token prediction. Moreover, diffusion-based regeneration attacks can effectively erase such watermarks by perturbing diffusion latent states. To address these challenges, we propose Lexical Bias Watermarking (LBW), a novel framework designed for AR models that resists regeneration attacks. LBW embeds watermarks directly into token maps by biasing token selection toward a predefined green list during generation. This approach ensures seamless integration with existing AR models and extends naturally to post-hoc watermarking. To increase the security against white-box attacks, instead of using a single green list, the green list for each image is randomly sampled from a pool of green lists. Watermark detection is performed via quantization and statistical analysis of the token distribution. Extensive experiments demonstrate that LBW achieves superior watermark robustness, particularly in resisting regeneration attacks.

Figures (11)

• Figure 1: Observation 1: Token consistency for VQ-GAN, VAR, and RAR across various codebook ratios ranging from 0.1 to 1.0.
• Figure 2: Observation 2: Image quality metrics (PSNR, SSIM, and FID) for AR reconstructed images across various codebook sizes, ranging from 0.1 to 1.0.
• Figure 3: Reconstructed images using only 10% of the original codebook size.
• Figure 4: Impact of $\gamma$ and $\sigma$ in robustness against Conventional (Con) and Regeneration (Reg) attacks.
• Figure 5: Comparison of token frequency distributions with varying green list number $N$.