Gaussian Shannon: High-Precision Diffusion Model Watermarking Based on Communication

Abstract

Diffusion models generate high-quality images but pose serious risks like copyright violation and disinformation. Watermarking is a key defense for tracing and authenticating AI-generated content. However, existing methods rely on threshold-based detection, which only supports fuzzy matching and cannot recover structured watermark data bit-exactly, making them unsuitable for offline verification or applications requiring lossless metadata (e.g., licensing instructions). To address this problem, in this paper, we propose Gaussian Shannon, a watermarking framework that treats the diffusion process as a noisy communication channel and enables both robust tracing and exact bit recovery. Our method embeds watermarks in the initial Gaussian noise without fine-tuning or quality loss. We identify two types of channel interference, namely local bit flips and global stochastic distortions, and design a cascaded defense combining error-correcting codes and majority voting. This ensures reliable end-to-end transmission of semantic payloads. Experiments across three Stable Diffusion variants and seven perturbation types show that Gaussian Shannon achieves state-of-the-art bit-level accuracy while maintaining a high true positive rate, enabling trustworthy rights attribution in real-world deployment. The source code have been made available at: https://github.com/Rambo-Yi/Gaussian-Shannon

Figures (17)

• Figure 1: Comparison of Watermark Types. ID-based watermarks require an online connection to query a database for copyright information, whereas analytical watermarks can be directly decoded and interpreted without external resources. For example, a watermark in a digital work can contain structured data such as licensor, licensee, timestamp, and permission flags.
• Figure 2: Modeling Watermarking as a Communication Process.The embedding and extraction of watermark information can be formulated as the transmission and reception of messages through a noisy channel. This perspective enables the application of established communication-theoretic techniques to enhance the reliability and fidelity of watermark recovery.
• Figure 3: Overview of the Gaussian Shannon framework. The watermark bitstream $\mathbf{w}$ is first encoded via LDPC into a codeword $\mathbf{c}$, which is then expanded to match the latent space dimension to yield $\mathbf{c}_R$. A pseudo-random modulation produces the signal $\mathbf{s}$, which guides the sampling of the initial Gaussian noise $\mathbf{z}_T$. The diffusion model subsequently denoises $\mathbf{z}_T$ to generate the watermarked image. During extraction, the process is inverted to recover $\mathbf{s}'$, followed by derandomization to obtain $\mathbf{c}'_R$. Watermark recovery proceeds in two stages: (i) direct LDPC decoding of individual codewords in $\mathbf{c}'_R$, or (ii) majority voting across redundant codewords to form an aggregated codeword $\tilde{\mathbf{c}}$, which is then decoded to reconstruct $\mathbf{w}$.
• Figure 4: Error bits(dark) in the latent variable. (a) Local errors + global random errors. (b) Global random errors. (c) Errors at JPEG25. (d) Majority voting only for (c). (e) Error correction only for (c). (f) Using both methods for (c).
• Figure 5: Watermarked images under different noises or attacks. (a) JPEG quality factor 25. (b) Gaussian blur radius=4. (c) Median filter k=7. (d) Gaussian noise $\sigma$ =0.05 (e) Brightness factor 2. (f) Scaling 0.3. (g) Random drop 0.25. (h) VAE compression (i) Diffusion attack. (j) Embedding attack.