ONRW: Optimizing inversion noise for high-quality and robust watermark

TL;DR

ONRW introduces a diffusion-model-based watermarking framework that optimizes inversion noise via null-text inversion to embed imperceptible watermarks while leveraging iterative denoising as a purification mechanism. Self-attention consistency and pseudo-mask foreground constraints preserve image semantics and improve robustness against transformations and attacks. The method also simulates attacks during training to further harden the watermark. Experiments on COCO and ImageNet show that ONRW achieves higher robustness and image quality than competitive diffusion-based watermarking methods, outperforming Stable Signature by about 10% on average across 12 transformations. The approach enables robust watermarking without additional training and highlights diffusion-model priors as a defense mechanism for intellectual-property protection.

Abstract

Watermarking methods have always been effective means of protecting intellectual property, yet they face significant challenges. Although existing deep learning-based watermarking systems can hide watermarks in images with minimal impact on image quality, they often lack robustness when encountering image corruptions during transmission, which undermines their practical application value. To this end, we propose a high-quality and robust watermark framework based on the diffusion model. Our method first converts the clean image into inversion noise through a null-text optimization process, and after optimizing the inversion noise in the latent space, it produces a high-quality watermarked image through an iterative denoising process of the diffusion model. The iterative denoising process serves as a powerful purification mechanism, ensuring both the visual quality of the watermarked image and enhancing the robustness of the watermark against various corruptions. To prevent the optimizing of inversion noise from distorting the original semantics of the image, we specifically introduced self-attention constraints and pseudo-mask strategies. Extensive experimental results demonstrate the superior performance of our method against various image corruptions. In particular, our method outperforms the stable signature method by an average of 10\% across 12 different image transformations on COCO datasets. Our codes are available at https://github.com/920927/ONRW.

Figures (6)

• Figure 1: Watermarking Algorithm Types. The post-generation method is straightforward to implement but still requires improvements in both security and efficiency, whereas the in-generation method, primarily reliant on generative models, needs further enhancement in watermark imperceptibility. Our method converts a clean image into inversion noise through the null-text inversion process and then embeds the watermark by optimizing this inversion noise.
• Figure 2: Framework of ONRW. We adopt Stable Diffusion and leverage null-text inversion to convert the clean image into inversion noise. The noise is optimized to embed the watermark information. Self-Attention and MSE loss controls ensure concealment, while decoder optimization enhances robustness. Areas are color-coded: blue for Watermark Robustness Control, green for Self-Attention Control, and pink for Pseudo Mask Strategy.
• Figure 3: Watermarked image and pixel-level differences from the original image (magnified three times for enhanced visual clarity) on COCO dataset. Our method embeds the watermark in key areas with minimal impact on the background.
• Figure 4: Qualitative comparison of watermarked images generated by our method and the existing generative model-based watermarking method Stable Signature.
• Figure 5: Visual comparison of the robustness of various watermark generation models against different types of neural autoencoder attacks under varying compression rates.