NoisePrints: Distortion-Free Watermarks for Authorship in Private Diffusion Models

TL;DR

NoisePrints addresses the challenge of proving authorship for privately deployed diffusion-generated content without altering generation or requiring model weights. It introduces a seed-based watermark that leverages the strong correlation between the initial noise $\varepsilon(h(s))$ and the final image, enabling lightweight verification via the cosine similarity $\phi(x,s)=\frac{\langle E(x),\varepsilon(h(s))\rangle}{\|E(x)\|_2\,\|\varepsilon(h(s))\|_2}$ and a calibrated threshold $\tau$. A dispute protocol and zero-knowledge proofs further enhance robustness against geometric transformations and avoid revealing the seed, while the approach remains model-agnostic and inversion-free, yielding large speedups over inversion-based baselines. Empirical results across multiple models and modalities demonstrate high reliability (near-perfect pass rates at $\text{FPR}=2^{-128}$) and strong robustness under common attacks, including SDEdit, DDIM inversion, and geometric transformations. This framework provides creators with a practical, scalable, and cryptographically grounded tool for asserting authorship in the growing landscape of diffusion-generated content.

Abstract

With the rapid adoption of diffusion models for visual content generation, proving authorship and protecting copyright have become critical. This challenge is particularly important when model owners keep their models private and may be unwilling or unable to handle authorship issues, making third-party verification essential. A natural solution is to embed watermarks for later verification. However, existing methods require access to model weights and rely on computationally heavy procedures, rendering them impractical and non-scalable. To address these challenges, we propose , a lightweight watermarking scheme that utilizes the random seed used to initialize the diffusion process as a proof of authorship without modifying the generation process. Our key observation is that the initial noise derived from a seed is highly correlated with the generated visual content. By incorporating a hash function into the noise sampling process, we further ensure that recovering a valid seed from the content is infeasible. We also show that sampling an alternative seed that passes verification is infeasible, and demonstrate the robustness of our method under various manipulations. Finally, we show how to use cryptographic zero-knowledge proofs to prove ownership without revealing the seed. By keeping the seed secret, we increase the difficulty of watermark removal. In our experiments, we validate NoisePrints on multiple state-of-the-art diffusion models for images and videos, demonstrating efficient verification using only the seed and output, without requiring access to model weights.

Figures (17)

• Figure 1: NoisePrint introduces no intervention in the generation process and therefore does not alter the distribution of generated images. For verification, we compare the noise derived from the seed with the given image. In contrast to other approaches that rely on DDIM inversion and compare the predicted initial noise to a key (i.e., a pre-embedded watermarking pattern) to decide authorship, our method is lightweight and model-free.
• Figure 2: Robustness of different methods against common post-processing attacks. We evaluate brightness changes (top), Gaussian blur (middle), and Gaussian noise (bottom) at varying levels of severity.
• Figure 3: Robustness of different methods against regeneration and inversion attacks (using a different model).
• Figure 4: Circuit for computing dot product and square of the magnitude. The circuit is instantiated with a function $\mathsf{ND}$ that on a random input simulates sampling an element from normal distribution.
• Figure 5: Circuit for combining all dot products and squared magnitudes.

Theorems & Definitions (4)

• Theorem 1: Exact spherical-cap probability
• proof
• Theorem 2: Exponential bound
• proof : Proof