Learning to Watermark in the Latent Space of Generative Models

TL;DR

DistSeal introduces latent-space watermarking for diffusion and autoregressive image models, enabling post-hoc watermarks in latent representations and in-model watermarking via distillation into either the model or its latent decoder. Latent watermarkers demonstrate competitive robustness with up to 20× speedups over pixel-space baselines, and distillation into the latent decoder or generative model preserves or enhances watermark robustness while maintaining image quality. The work provides a detailed comparison of post-hoc vs in-model trade-offs, analyzes watermark formation during generation, and offers practical guidance for deployment and multi-watermarking scenarios. It also outlines limitations and directions for future work, including extensions to video and stronger attack defenses.

Abstract

Existing approaches for watermarking AI-generated images often rely on post-hoc methods applied in pixel space, introducing computational overhead and potential visual artifacts. In this work, we explore latent space watermarking and introduce DistSeal, a unified approach for latent watermarking that works across both diffusion and autoregressive models. Our approach works by training post-hoc watermarking models in the latent space of generative models. We demonstrate that these latent watermarkers can be effectively distilled either into the generative model itself or into the latent decoder, enabling in-model watermarking. The resulting latent watermarks achieve competitive robustness while offering similar imperceptibility and up to 20x speedup compared to pixel-space baselines. Our experiments further reveal that distilling latent watermarkers outperforms distilling pixel-space ones, providing a solution that is both more efficient and more robust.

Figures (18)

• Figure 1: Overview of DistSeal. We train a post-hoc embedder/extractor pair, where the embedder operates in the latent space (top). We may then distill the embedder into the diffusion or autoregressive model (bottom). Fig. \ref{['appfig:method-decoder']} details the distillation in the latent decoder.
• Figure 2: The decoder of the generative model can be distilled to produce watermarked images from non-watermarked latents.
• Figure 3: We compare pixel (top) and latent (bottom) post-hoc watermarks on a DCAE-generated image (ImageNet class=360). In the second column, we show the watermarked images after applying the post-hoc watermarkers. In the third column, we show in-model outputs after distilling the respective watermarkers into the latent decoder. In the last two columns, we show the difference images between the watermarked and reference images.
• Figure 4: We compare pixel (top) and latent (bottom) post-hoc watermarks on a RAR-generated image (ImageNet class=975). In the second column, we show the watermarked images after applying the post-hoc watermarkers. In the third column, we show in-model outputs after distilling the respective watermarkers into the latent decoder. Here, the post-hoc latent watermarker is applied after the quantization step. In the last two columns, we show the difference images between the watermarked and reference images.
• Figure 5: Bit accuracy over diffusion steps: detection improves during the generation process, using the distilled model from the beginning (left), or only for the last N diffusion steps (right).