ALIEN: Analytic Latent Watermarking for Controllable Generation

TL;DR

This work tackles the need for robust, efficient watermarking in latent diffusion models by introducing ALIEN, an analytic framework that derives a time-dependent drift correction for the VP-SDE to embed a watermark residual in the latent space. By mapping a fixed watermark delta $\mathbf{\delta}_{wm}$ to a correction term for the noise prediction, ALIEN achieves sampler-agnostic embedding without iterative optimization, preserving semantic fidelity. The method comprises Imperceptible Latent Watermark Generation and Analytic SDE Reverse Drift Correction, enforcing the constraint $\hat{\mathbf{z}}_0^{wm} = \hat{\mathbf{z}}_0^{orig} + \mathbf{\delta}_{wm}$ through closed-form equations for $\Delta \mathbf{F}_{rev}$ and the corresponding $\epsilon^{target}$. Empirical results show that ALIEN-Q improves fidelity metrics by about 33% across five metrics and ALIEN-R improves robustness across 15 conditions by about 14%, while maintaining sampler compatibility and resistance to diffusion inversion, signaling substantial practical impact for watermarking in generative AI systems.

Abstract

Watermarking is a technical alternative to safeguarding intellectual property and reducing misuse. Existing methods focus on optimizing watermarked latent variables to balance watermark robustness and fidelity, as Latent diffusion models (LDMs) are considered a powerful tool for generative tasks. However, reliance on computationally intensive heuristic optimization for iterative signal refinement results in high training overhead and local optima entrapment.To address these issues, we propose an \underline{A}na\underline{l}ytical Watermark\underline{i}ng Framework for Controllabl\underline{e} Generatio\underline{n} (ALIEN). We develop the first analytical derivation of the time-dependent modulation coefficient that guides the diffusion of watermark residuals to achieve controllable watermark embedding pattern.Experimental results show that ALIEN-Q outperforms the state-of-the-art by 33.1\% across 5 quality metrics, and ALIEN-R demonstrates 14.0\% improved robustness against generative variant and stability threats compared to the state-of-the-art across 15 distinct conditions. Code can be available at https://anonymous.4open.science/r/ALIEN/.

Figures (10)

• Figure 1: (a) Latent modification, (b) Constrained sampling, (c) Iterative optimization, (d) Our ALIEN with principled embedding.
• Figure 2: The ALIEN framework consists of two main stages: (Top) Imperceptible Latent Watermark Generation, where a secret encoder $E_s$ and decoder $D_s$ are trained to embed a message $m$ into a robust latent residual $\delta_w$ while preserving image quality. (Bottom) Analytic SDE Reverse Drift Correction, which applies the time-dependent modulation to the noise prediction. This principled correction steers the generative trajectory to satisfy the watermark constraint in a sampler-agnostic manner.
• Figure 3: Comparison of ALIEN-R and ALIEN-Q. (a) The L2 norm of noise prediction during the diffusion process. (b) The evolution of injection strength $\frac{\sqrt{\bar{\alpha}_t}}{\sqrt{1 - \bar{\alpha}_t}}$.
• Figure 4: Qualitative comparison of watermarked samples and $10\times$ magnified residuals. We compare ALIEN with baselines covering post-processing (StegaStamp), latent modification (Tree-Ring), optimization (ROBIN, ZoDiac), and fine-tuning (AquaLoRA, StableSig.).
• Figure 5: Visual Comparison under Different Generation Schedulers (DDIM, DPM2 a, Euler a, and DPM++ 2M SDE).