TAG-WM: Tamper-Aware Generative Image Watermarking via Diffusion Inversion Sensitivity

TL;DR

This work introduces TAG-WM, a tamper-aware watermarking framework embedded directly into diffusion-model generation to simultaneously protect copyright and localize tampering. It combines dual watermark embedding via a DMJS scheme, latent reconstruction for extraction, a dense variation region detector for tamper localization, and tamper-aware decoding to robustly recover watermarks under manipulation. The approach achieves state-of-the-art tampering robustness and localization, maintains high generation quality, and supports a 256-bit watermark capacity with substantial speed advantages over post-processing methods. The results offer a practical pathway for provenance and authenticity in AI-generated imagery, while also outlining limitations and directions for future enhancements.

Abstract

AI-generated content (AIGC) enables efficient visual creation but raises copyright and authenticity risks. As a common technique for integrity verification and source tracing, digital image watermarking is regarded as a potential solution to above issues. However, the widespread adoption and advancing capabilities of generative image editing tools have amplified malicious tampering risks, while simultaneously posing new challenges to passive tampering detection and watermark robustness. To address these challenges, this paper proposes a Tamper-Aware Generative image WaterMarking method named TAG-WM. The proposed method comprises four key modules: a dual-mark joint sampling (DMJS) algorithm for embedding copyright and localization watermarks into the latent space while preserving generative quality, the watermark latent reconstruction (WLR) utilizing reversed DMJS, a dense variation region detector (DVRD) leveraging diffusion inversion sensitivity to identify tampered areas via statistical deviation analysis, and the tamper-aware decoding (TAD) guided by localization results. The experimental results demonstrate that TAG-WM achieves state-of-the-art performance in both tampering robustness and localization capability even under distortion, while preserving lossless generation quality and maintaining a watermark capacity of 256 bits. The code is available at: https://github.com/Suchenl/TAG-WM.

Figures (5)

• Figure 1: The proposed TAG-WM framework. It embeds copyright $W_{cop}$ and localization watermarks $W_{loc}$ through dual-watermark joint sampling strategy. By analyzing dense variation regions of $W_{loc}$, it enables tamper localization while improving watermark decoding accuracy using tampering insights.
• Figure 2: Embedding strategies for bit pairs $(w_{c},w_{l})$.
• Figure 3: Comparative results in tampering scenarios using Gaussian Shading (GS) and EditGuard. We evaluate two types of tampering at ten different ratios for both clean and degraded images. The "Tampering Ratio" refers to the ratio of the area of tampering to the total image area.
• Figure 4: Visual comparison results with EditGuard. Degraded refers to images that have been tampered with and subsequently degraded, with the type and degree of degradation labeled at the top. The clean and degraded labels below the two methods refer to the predicted localization results for tampered images and degraded tampered images, respectively.
• Figure 5: Robustness of our method to image degradations.