Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

When Denoising Becomes Unsigning: Theoretical and Empirical Analysis of Watermark Fragility Under Diffusion-Based Image Editing

Fai Gu, Qiyu Tang, Te Wen, Emily Davis, Finn Carter

TL;DR

A unified view of diffusion editors that inject substantial Gaussian noise in a latent space and project back to the natural image manifold via learned denoising dynamics is developed, proving that for broad classes of pixel-level watermark encoders/decoders the mutual information between the watermark payload and the edited output decays toward zero as the editing strength increases, yielding decoding error close to random guessing.

Abstract

Robust invisible watermarking systems aim to embed imperceptible payloads that remain decodable after common post-processing such as JPEG compression, cropping, and additive noise. In parallel, diffusion-based image editing has rapidly matured into a default transformation layer for modern content pipelines, enabling instruction-based editing, object insertion and composition, and interactive geometric manipulation. This paper studies a subtle but increasingly consequential interaction between these trends: diffusion-based editing procedures may unintentionally compromise, and in extreme cases practically bypass, robust watermarking mechanisms that were explicitly engineered to survive conventional distortions. We develop a unified view of diffusion editors that (i) inject substantial Gaussian noise in a latent space and (ii) project back to the natural image manifold via learned denoising dynamics. Under this view, watermark payloads behave as low-energy, high-frequency signals that are systematically attenuated by the forward diffusion step and then treated as nuisance variation by the reverse generative process. We formalize this degradation using information-theoretic tools, proving that for broad classes of pixel-level watermark encoders/decoders the mutual information between the watermark payload and the edited output decays toward zero as the editing strength increases, yielding decoding error close to random guessing. We complement the theory with a realistic hypothetical experimental protocol and tables spanning representative watermarking methods and representative diffusion editors. Finally, we discuss ethical implications, responsible disclosure norms, and concrete design guidelines for watermarking schemes that remain meaningful in the era of generative transformations.

When Denoising Becomes Unsigning: Theoretical and Empirical Analysis of Watermark Fragility Under Diffusion-Based Image Editing

TL;DR

A unified view of diffusion editors that inject substantial Gaussian noise in a latent space and project back to the natural image manifold via learned denoising dynamics is developed, proving that for broad classes of pixel-level watermark encoders/decoders the mutual information between the watermark payload and the edited output decays toward zero as the editing strength increases, yielding decoding error close to random guessing.

Abstract

Robust invisible watermarking systems aim to embed imperceptible payloads that remain decodable after common post-processing such as JPEG compression, cropping, and additive noise. In parallel, diffusion-based image editing has rapidly matured into a default transformation layer for modern content pipelines, enabling instruction-based editing, object insertion and composition, and interactive geometric manipulation. This paper studies a subtle but increasingly consequential interaction between these trends: diffusion-based editing procedures may unintentionally compromise, and in extreme cases practically bypass, robust watermarking mechanisms that were explicitly engineered to survive conventional distortions. We develop a unified view of diffusion editors that (i) inject substantial Gaussian noise in a latent space and (ii) project back to the natural image manifold via learned denoising dynamics. Under this view, watermark payloads behave as low-energy, high-frequency signals that are systematically attenuated by the forward diffusion step and then treated as nuisance variation by the reverse generative process. We formalize this degradation using information-theoretic tools, proving that for broad classes of pixel-level watermark encoders/decoders the mutual information between the watermark payload and the edited output decays toward zero as the editing strength increases, yielding decoding error close to random guessing. We complement the theory with a realistic hypothetical experimental protocol and tables spanning representative watermarking methods and representative diffusion editors. Finally, we discuss ethical implications, responsible disclosure norms, and concrete design guidelines for watermarking schemes that remain meaningful in the era of generative transformations.
Paper Structure (68 sections, 4 theorems, 19 equations, 10 tables, 1 algorithm)

This paper contains 68 sections, 4 theorems, 19 equations, 10 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Contributions.
  3. Related Work
  4. Diffusion-based image editing
  5. Robust invisible watermarking and deep learning-based schemes
  6. Watermark robustness against generative transformations
  7. Benchmarks for diffusion editing and watermark robustness
  8. Concept erasure in diffusion models.
  9. Methodology
  10. Problem setting
  11. Diffusion editing as a two-stage stochastic channel
  12. A signal model for watermark attenuation
  13. Pipeline-specific considerations: TF-ICON, SHINE, DragFlow
  14. TF-ICON.
  15. SHINE.
  16. ...and 53 more sections

Key Result

Lemma 1

Let $Z$ be generated from $X$ by eq:gaussian_step. For any two distributions $P$ and $Q$ over $X$, the KL divergence between the induced distributions over $Z$ satisfies where $P_Z$ and $Q_Z$ denote the pushforward distributions through the Gaussian channel.

Theorems & Definitions (8)

  • Lemma 1: KL contraction in an additive Gaussian channel
  • proof
  • Theorem 1: Information loss under diffusion editing
  • proof
  • Proposition 1: Exponential contraction across Gaussian steps
  • proof
  • Theorem 2: Fano-style lower bound on bit error
  • proof