Pith. sign in

REVIEW 3 major objections 6 minor 1 cited by

Watermarking Visual Concepts for Diffusion Models

T0 review · 3 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that a single latent watermark can both identify the visual concept in a generated image and trace which diffusion model made it, and that embedding an adversarial perturbation alongside the watermark degrades images…

desk verdict Concept-specific tracing is a real step forward; the fine-tuning-resistance headline needs a control and a defined metric. read the letter →

arxiv 2411.11688 v3 pith:A4HFRK5K submitted 2024-11-18 cs.CR cs.AIcs.MM

Liangqi Lei , Keke Gai , Jing Yu , Liehuang Zhu , Qi Wu This is my paper · ORCID
classification cs.CRcs.AIcs.MM
keywords conceptwatermarkingdiffusionmodelslatentadversarialperturbationDreamBoothmodeltracingcopyrightprotectionStable
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes ConceptWM, a lightweight concept watermarking framework for diffusion models. It tries to establish that a watermark bit sequence, a visual concept, and a textual pseudo-word can be bound together during model fine-tuning, so one watermark check identifies both the concept and the source model. It further claims that an imperceptible adversarial perturbation embedded with the watermark prevents attackers from using generated concept images to fine-tune their own diffusion models: outputs from such fine-tuned models are severely degraded. If true, this would replace the two-stage pipeline of concept detection followed by model tracing with a single-step verification, giving creators a direct way to trace and protect specific visual concepts.

What carries the argument

The framework has three components. Fidelity-preserving Latent Watermarking (FLW) embeds an image-dependent watermark in latent space using a combination layer plus LPIPS and peak-pixel-difference losses, making the watermark learnable by the U-Net and visually imperceptible. Imperceptible Adversarial Perturbation Injection (IAPI) trains a surrogate model with one-step DreamBooth on clean reference images and runs PGD to craft a perturbation $\varphi$ that maximizes the conditional generation loss, so the perturbation transfers its damaging effect to independently fine-tuned models. Efficient Concept Watermark Training (ECWT) alternates DreamBooth concept learning with watermark learning on the difference between watermarked and non-watermarked predictions, allowing the U-Net to learn the concept and the adversarial watermark together. The load-bearing mechanism is the latent fusion layer combined with the PGD-computed perturbation that survives fine-tuning and model-version changes.

What would settle it

Fine-tune a fresh Stable Diffusion model with DreamBooth on ConceptWM-generated concept images, without using the surrogate model or the optimization recipe, and compare FID and perceptual quality against a no-watermark control trained on the same concept images; if the control and the ConceptWM-trained model produce similarly high-quality concept images, the central protection claim is refuted.

Watch

Extended reading notes

Core claim

The central claim is that concept-level tracing and concept-level protection can be achieved in a single watermarking pass rather than by combining image watermarking with separate concept detection. ConceptWM establishes a tripartite correlation: a chosen bit sequence (the watermark), a visual concept (for example, a particular person or artistic style), and a textual concept (a pseudo-word used in prompts). During generation, the watermarked U-Net produces concept images whose latent codes contain both the watermark and a small adversarial perturbation. Experiments report bit accuracy around 0.93 to 0.96, robustness across eight image distortions with average bit accuracy of 91.34 percent, and a 6.3 to 19.3 percent detection-accuracy improvement over baseline watermarking methods. The paper also reports that fine-tuning a Stable Diffusion model on ConceptWM images with DreamBooth, LoRA, or Textual Inversion yields strongly degraded images, with PIQE up to 63.18 and FID up to 87.21 in the reported settings.

Load-bearing premise

The adversarial protection stands or falls on whether a perturbation computed against a surrogate model trained on clean reference images still degrades the outputs of independently fine-tuned diffusion models; the paper does not report a no-watermark control or a definition of the 21.7 percent degradation figure.

Editorial extensions

If this is right

  • Concept-level tracing becomes one step: a watermark decoder on any generated image returns both the concept identity and the model or user ID, skipping separate concept detection.
  • The adversarial watermark transfers across Stable Diffusion versions (v1.4 and v2.1) and across personalization methods (DreamBooth, LoRA, and Textual Inversion), so a single watermarked release can degrade several fine-tuning pipelines.
  • Because the watermark is embedded in latent space with a learned distortion layer, it withstands image processing, geometric, VAE-compression, and diffusion-reconstruction attacks better than the compared baselines.
  • The framework requires only a few reference images and localized fine-tuning, so it can be applied per concept without retraining the whole generator.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the transferability result holds, the same latent watermark could carry attribution metadata while the adversarial component raises the cost of unauthorized fine-tuning; combining these two functions in one perturbation is a natural extension the paper does not explore.
  • An adaptive attacker who knows about the watermark could fine-tune on images after JPEG or VAE compression or with a larger noise budget; testing ConceptWM against such an adaptive adversary is a direct next step beyond the paper's current attack set.
  • The reported 21.7 percent FID/CLIP degradation is asserted without a defined metric; specifying it as a relative change against a no-watermark fine-tuned control would make the claim directly falsifiable.
  • The concept binding is demonstrated for DreamBooth-style subject and style concepts; extending the same tripartite binding to multi-concept LoRA or Textual Inversion is the paper's stated future direction and would show whether the mechanism scales beyond single-concept fine-tuning.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes ConceptWM, a concept-level watermarking framework for Stable Diffusion. It combines a fidelity-preserving latent watermark module (FLW), an imperceptible adversarial perturbation injection module (IAPI), and alternating DreamBooth/watermark training. The goal is to establish a tripartite correlation among a watermark bit sequence, a visual concept, and a textual concept, enabling single-stage concept tracing and proactive defense against personalization fine-tuning. Experiments compare ConceptWM with DwtDctSvd, RivaGAN, Stable Signature, and Tree-Ring under image distortions and inference variations, and test the adversarial watermark's transfer to DreamBooth, LoRA, and Textual Inversion fine-tuning under model-version mismatch.

Significance. If the central claims hold, the paper would make a useful advance over image-level watermarking by supporting concept-level tracing and a proactive defense against fine-tuning-based watermark removal. The robustness evaluation across samplers, guidance scales, VAE versions, and eight distortion types is a genuine strength, and the authors provide an anonymous code link. However, the most distinctive claim—that ConceptWM forces a 21.7% FID/CLIP degradation in fine-tuned models—is not currently established because the metric is undefined and no no-watermark control is provided. Several numerical claims are also not reproducible from the reported tables, so the contribution is only partially supported.

major comments (3)
  1. [Concept Protection Evaluation / Table 4 / Abstract] The central claim that ConceptWM "sustains a 21.7% FID/CLIP degradation under adversarial fine-tuning" is not supported by the reported data. The 21.7% figure is never defined; the only way I can reconstruct it from Table 4 is the relative CLIP drop from 0.367 (Table 1, "None") to 0.287 (Table 4, v2.1→v1.4), but the text does not say this. More importantly, Table 4 contains no no-watermark control condition: fine-tuning the same DreamBooth/LoRA/Textual Inversion recipes on clean concept images without ConceptWM is not reported. Because personalization with 5–8 images can itself substantially degrade FID and quality metrics, the PIQE/NIQE/CLIP/FID values in Table 4 cannot be attributed to the adversarial watermark. The manuscript should define the degradation metric, add the control, and report run counts and error bars.
  2. [Imperceptible Adversarial Perturbation Injection, Eqs. (5)–(6)] The surrogate model used for PGD is described as trained on "clean referenced images XB", but Eq. (5) defines θ* = argmin_θ Σ_{x∈XA} L_ft(θ, xi), i.e., over XA. Since θ* is exactly the model used in Eq. (6) to compute the adversarial perturbation, the notation must be aligned with the description. If XA and XB are indeed different, the current equation trains the surrogate on the wrong set; if they are the same, the text should say so. This matters because the transferability of φ to independently fine-tuned target models is the load-bearing assumption for the defense claim.
  3. [Abstract / Table 1 / Table 2] The claimed detection improvements are not reproducible from the reported tables. The abstract states a 6.3%–19.3% detection-accuracy improvement over baselines, and the text says "our method outperforms the best baseline by around 6.3%" in the discussion of Table 2. However, Table 2 average bit accuracy is 91.34 for ConceptWM versus 86.59 for RivaGAN (a 4.75-percentage-point gap) and 83.31 for Stable Signature; no column in Table 2 yields a 6.3% margin. In Table 1 the FLW variant has clean BitAcc 95.68, lower than DwtDctSvd (99.98) and StableSig (98.49). Additionally, the abstract claims evaluation on "COCO and StableDiffusionDB", but the experiments section only mentions COCO for FID and reports no StableDiffusionDB results. Please specify how the margins are computed and provide the missing dataset results.
minor comments (6)
  1. [Ablation Studies / Prompt Mismatching] The paragraph "Prompt Mismatching" says the results are shown in Table 3, but Table 3 contains inference steps, samplers, guidance scales, generation size, and VAE results; the prompt-mismatch bit-accuracy numbers appear only in Figure 3. Please correct the cross-reference and report prompt-condition results in a proper table.
  2. [Fidelity-preserving Latent Watermark, Eq. (2)] Equation (2) introduces weighting coefficients λ and μ, but their values are never reported. Please add them to the training configurations for reproducibility.
  3. [Evaluation Metrics / Table 1 caption] The text writes "FPR of 10e-5" and the Table 1 caption uses "10−5"; the intended value is 10^{-5}, and the notation should be unified.
  4. [Watermarked Diffusion Model Fidelity] The text reports a "CLIP difference of 0.02" relative to the original model, but Table 1 gives FLW CLIP 0.365 versus "None" 0.367, a difference of 0.002; please correct the value.
  5. [Throughout] There are numerous typos, including "celibrities", "misue", "Adcersarial", "extrect", "huaman", and "componets"; a careful proofread is needed.
  6. [Tables 1–5] No error bars or repeated-run statistics are reported for any table. At least for the headline claims (watermark bit accuracy and the fine-tuning degradation numbers), please report variance across seeds or runs.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: the watermarking and adversarial-transfer results are empirical claims with external baselines, not reductions to the paper's own definitions or fitted values.

full rationale

ConceptWM's tracing objective is a conventional BCE watermark decoder trained against ground-truth bit strings and evaluated on generated images alongside four external baselines under matched protocols (Tables 1-2), so the reported accuracy is not forced by construction. The adversarial protection mechanism is optimized by PGD on a surrogate model (Eqs. 5-6) and then tested on separately fine-tuned DreamBooth/LoRA/Textual-Inversion models (Table 4); this is a transfer test whose outcome is not guaranteed by the training loss. The absence of a no-watermark control and the undefined 21.7% degradation metric are experimental-validity concerns, as is the overlap between Table 2 attack names and Table 5 distortion-layer augmentations, but none of these amounts to an equation-level reduction of an output to an input. There are no load-bearing self-citations or imported uniqueness claims, and no ansatz is smuggled in via citation. The central claims therefore retain independent empirical content, so the paper is not circular.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central claims rest on standard generative-model assumptions (DreamBooth concept learning from few images, Stable Diffusion as a base) plus the paper-specific assumption that a surrogate-model PGD perturbation transfers to real fine-tuning attacks. The free parameters are hand-chosen loss weights, perturbation budgets, and learning rates.

free parameters (5)
  • Loss coefficients λ and μ in Eq. (2) = not reported
    Trade-off weights for LPIPS and PPD losses in the FLW objective, chosen by hand and not swept.
  • PGD step size α = 1e-5
    Step size for adversarial perturbation optimization in the IAPI module, stated in Training Configurations.
  • Adversarial noise budget η = 1e-3
    Bound on the perturbation norm in Eq. (6), directly controlling the strength of the defense and the image-quality impact.
  • DreamBooth learning rate = 5e-6
    Learning rate for fine-tuning, affecting concept learning and watermark embedding.
  • Distortion layer augmentations = not specified
    The robustness evaluation depends on which distortions were used during watermark pretraining; the composition is not fully specified in the main text.
assumptions (4)
  • domain assumption DreamBooth fine-tuning with 5-8 images is sufficient to learn a target concept and to co-learn a watermark pattern in the U-Net.
    The method is built on DreamBooth and the paper uses 5-8 reference images per concept (Experiment, Datasets).
  • ad hoc to paper The adversarial perturbation computed against a surrogate one-step-DreamBooth model transfers to other fine-tuning methods and model versions.
    Eqs. (5)-(6) train the surrogate on clean reference images XB; Table 4 assumes this transfers to LoRA, Textual Inversion, and cross-version models.
  • domain assumption Stable Diffusion v2.1 U-Net can absorb latent-space watermarks and adversarial perturbations without materially changing output fidelity.
    The FLW module is inserted into the U-Net latent path; fidelity is measured but not proven to hold beyond the reported concepts.
  • domain assumption The message decoder and distortion layer trained on the target concept generalize across prompts, samplers, and generation settings.
    Prompt adaptation and inference-setting robustness are tested, but the decoder is only trained on a limited prompt set.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Watermarking Visual Concepts for Diffusion Models." pith.science (2026). https://pith.science/paper/A4HFRK5K

@misc{pith2026241111688,
  author       = {Pith},
  title        = {Pith review of: Watermarking Visual Concepts for Diffusion Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/A4HFRK5K}},
  note         = {Machine review of arXiv:2411.11688}
}
read the original abstract

The personalization techniques of diffusion models succeed in generating images with specific concepts. This ability also poses great threats to copyright protection and network security since malicious users can generate unauthorized content and disinformation relevant to a target concept. Model watermarking is an effective solution to trace the malicious generated images and safeguard their copyright. However, existing model watermarking techniques merely achieve image-level tracing without concept traceability. When tracing infringing or harmful concepts, current approaches execute image concept detection and model tracing sequentially, where performance is critically constrained by concept detection accuracy. In this paper, we propose a lightweight concept watermarking framework that efficiently binds target concepts to model watermarks, supporting simultaneous concept identification and model tracing via single-stage watermark verification. To further enhance the robustness of concept watermarking, we propose an adversarial perturbation injection method collaboratively embedded with watermarks during image generation, avoiding watermark removal by model purification attacks. Experimental results demonstrate that ConceptWM significantly outperforms state-of-the-art watermarking methods, improving detection accuracy by 6.3%-19.3% across diverse datasets including COCO and StableDiffusionDB. Additionally, ConceptWM possesses a critical capability absent in other watermarking methods: it sustains a 21.7% FID/CLIP degradation under adversarial fine-tuning of Stable Diffusion models on WikiArt and CelebA-HQ, demonstrating its capability to mitigate model misuse.

Figures

Figures reproduced from arXiv: 2411.11688 by the authors.

Figure 1
Figure 1. Five main kinds of diffusion model watermarking [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Framework of ConceptWM. The ECWT module employs a two-step training process to learn specific concepts and [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Demonstration of the generated images. Below each image, we display the corresponding Bit Accuracy, along with [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Adversarial Attacks for Good: A Survey of Proactive Protection across the Visual Content Lifecycle

    cs.CR 2026-08 accept novelty 5.0 of 10

    The paper unifies privacy filters, unlearnable examples, generative safeguards, adversarial CAPTCHAs, and provenance marks into a single 'adversarial attacks for good' lifecycle and evaluates them along three common axes.

Reference graph

Works this paper leans on

44 extracted references · 12 canonical work pages · cited by 1 Pith paper

  1. [1]

    , " * write output.state after.block = add.period write newline

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    An, B.; Ding, M.; Rabbani, T.; Agrawal, A.; Xu, Y.; Deng, C.; Zhu, S.; Mohamed, A.; Wen, Y.; Goldstein, T.; et al. 2024. Benchmarking the robustness of image watermarks. arXiv preprint arXiv:2401.08573

    arXiv 2024

  4. [4]

    J.; and Johnston, N

    Ball \'e , J.; Minnen, D.; Singh, S.; Hwang, S. J.; and Johnston, N. 2018. Variational image compression with a scale hyperprior. arXiv preprint arXiv:1802.01436

    arXiv 2018

  5. [5]

    Cheng, Z.; Sun, H.; Takeuchi, M.; and Katto, J. 2020. Learned image compression with discretized gaussian mixture likelihoods and attention modules. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 7939--7948

    work page 2020

  6. [6]

    Cox, I.; Miller, M.; Bloom, J.; Fridrich, J.; and Kalker, T. 2007. Digital watermarking and steganography. Morgan kaufmann

    work page 2007

  7. [7]

    Cui, Y.; Ren, J.; Lin, Y.; Xu, H.; He, P.; Xing, Y.; Lyu, L.; Fan, W.; Liu, H.; and Tang, J. 2025. Ft-shield: A watermark against unauthorized fine-tuning in text-to-image diffusion models. ACM SIGKDD Explorations Newsletter, 26(2): 76--88

    work page 2025

  8. [8]

    Feng, W.; Zhou, W.; He, J.; Zhang, J.; Wei, T.; Li, G.; Zhang, T.; Zhang, W.; and Yu, N. 2024. AquaLoRA: Toward White-box Protection for Customized Stable Diffusion Models via Watermark LoRA. arXiv preprint arXiv:2405.11135

    arXiv 2024

Show all 44 references
  1. [9]

    Fernandez, P.; Couairon, G.; J \'e gou, H.; Douze, M.; and Furon, T. 2023. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 22466--22477

    2023

  2. [10]

    H.; Chechik, G.; and Cohen-Or, D

    Gal, R.; Alaluf, Y.; Atzmon, Y.; Patashnik, O.; Bermano, A. H.; Chechik, G.; and Cohen-Or, D. 2022. An image is worth one word: Personalizing text-to-image generation using textual inversion. arXiv preprint arXiv:2208.01618

    2022 arXiv

  3. [11]

    H.; Chechik, G.; and Cohen-Or, D

    Gal, R.; Arar, M.; Atzmon, Y.; Bermano, A. H.; Chechik, G.; and Cohen-Or, D. 2023. Encoder-based domain tuning for fast personalization of text-to-image models. ACM Transactions on Graphics (TOG), 42(4): 1--13

    2023

  4. [12]

    Heusel, M.; Ramsauer, H.; Unterthiner, T.; Nessler, B.; and Hochreiter, S. 2017. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems, 30

    2017

  5. [13]

    Hore, A.; and Ziou, D. 2010. Image quality metrics: PSNR vs. SSIM. In 2010 20th international conference on pattern recognition, 2366--2369. IEEE

    2010

  6. [14]

    J.; Shen, Y.; Wallis, P.; Allen-Zhu, Z.; Li, Y.; Wang, S.; Wang, L.; and Chen, W

    Hu, E. J.; Shen, Y.; Wallis, P.; Allen-Zhu, Z.; Li, Y.; Wang, S.; Wang, L.; and Chen, W. 2021. Lora: Low-rank adaptation of large language models. arXiv preprint arXiv:2106.09685

    2021 arXiv

  7. [15]

    Karras, T.; Aittala, M.; Aila, T.; and Laine, S. 2022. Elucidating the design space of diffusion-based generative models. Advances in neural information processing systems, 35: 26565--26577

    2022

  8. [16]

    Kim, C.; Min, K.; Patel, M.; Cheng, S.; and Yang, Y. 2024. WOUAF: Weight modulation for user attribution and fingerprinting in text-to-image diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 8974--8983

    2024

  9. [17]

    Kumari, N.; Zhang, B.; Zhang, R.; Shechtman, E.; and Zhu, J.-Y. 2023. Multi-concept customization of text-to-image diffusion. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 1931--1941

    2023

  10. [18]

    Li, B.; Wei, Y.; Fu, Y.; Wang, Z.; Li, Y.; Zhang, J.; Wang, R.; and Zhang, T. 2025. Towards reliable verification of unauthorized data usage in personalized text-to-image diffusion models. In 2025 IEEE Symposium on Security and Privacy (SP), 2564--2582. IEEE

    2025

  11. [19]

    Liang, C.; Wu, X.; Hua, Y.; Zhang, J.; Xue, Y.; Song, T.; Xue, Z.; Ma, R.; and Guan, H. 2023. Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples. arXiv preprint arXiv:2302.04578

    2023 arXiv

  12. [20]

    Lin, T.-Y.; Maire, M.; Belongie, S.; Hays, J.; Perona, P.; Ramanan, D.; Doll \'a r, P.; and Zitnick, C. L. 2014. Microsoft coco: Common objects in context. In Computer Vision--ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 1...

    2014

  13. [21]

    Lu, C.; Zhou, Y.; Bao, F.; Chen, J.; Li, C.; and Zhu, J. 2022. Dpm-solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps. Advances in Neural Information Processing Systems, 35: 5775--5787

    2022

  14. [22]

    Madry, A. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083

    2017 arXiv

  15. [23]

    completely blind

    Mittal, A.; Soundararajan, R.; and Bovik, A. C. 2012. Making a “completely blind” image quality analyzer. IEEE Signal Processing Letters, 20(3): 209--212

    2012

  16. [24]

    W.; Hallacy, C.; Ramesh, A.; Goh, G.; Agarwal, S.; Sastry, G.; Askell, A.; Mishkin, P.; Clark, J.; Krueger, G.; and Sutskever, I

    Radford, A.; Kim, J. W.; Hallacy, C.; Ramesh, A.; Goh, G.; Agarwal, S.; Sastry, G.; Askell, A.; Mishkin, P.; Clark, J.; Krueger, G.; and Sutskever, I. 2021. Learning Transferable Visual Models From Natural Language Supervision. In ICML

    2021

  17. [25]

    Rombach, R.; Blattmann, A.; Lorenz, D.; Esser, P.; and Ommer, B. 2022. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 10684--10695

    2022

  18. [26]

    Ruiz, N.; Li, Y.; Jampani, V.; Pritch, Y.; Rubinstein, M.; and Aberman, K. 2023. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 22500--22510

    2023

  19. [27]

    Shi, J.; Xiong, W.; Lin, Z.; and Jung, H. J. 2024. Instantbooth: Personalized text-to-image generation without test-time finetuning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 8543--8552

    2024

  20. [28]

    Song, J.; Meng, C.; and Ermon, S. 2020. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502

    2020 arXiv

  21. [29]

    H.; Dao, Q.; Tran, N

    Van Le, T.; Phung, H.; Nguyen, T. H.; Dao, Q.; Tran, N. N.; and Tran, A. 2023. Anti-dreambooth: Protecting users from personalized text-to-image synthesis. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 2116--2127

    2023

  22. [30]

    C.; Channappayya, S

    Venkatanath, N.; Praneeth, D.; Bh, M. C.; Channappayya, S. S.; and Medasani, S. S. 2015. Blind image quality evaluation using perception based features. In 2015 Twenty First National Conference on Communications, 1--6. IEEE

    2015

  23. [31]

    Wang, F.; Tan, Z.; Wei, T.; Wu, Y.; and Huang, Q. 2024. Simac: A simple anti-customization method for protecting face privacy against text-to-image synthesis of diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 12047--12056

    2024

  24. [32]

    C.; Sheikh, H

    Wang, Z.; Bovik, A. C.; Sheikh, H. R.; and Simoncelli, E. P. 2004. Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing, 13(4): 600--612

    2004

  25. [33]

    Wen, Y.; Kirchenbauer, J.; Geiping, J.; and Goldstein, T. 2024. Tree-rings watermarks: Invisible fingerprints for diffusion images. Advances in Neural Information Processing Systems, 36

    2024

  26. [34]

    Wu, R.; Wang, Y.; Shi, H.; Yu, Z.; Wu, Y.; and Liang, D. 2023. Towards prompt-robust face privacy protection via adversarial decoupling augmentation framework. arXiv preprint arXiv:2305.03980

    2023 arXiv

  27. [35]

    Xiong, C.; Qin, C.; Feng, G.; and Zhang, X. 2023. Flexible and secure watermarking for latent diffusion model. In Proceedings of the 31st ACM International Conference on Multimedia, 1668--1676

    2023

  28. [36]

    Ye, X.; Huang, H.; An, J.; and Wang, Y. 2023. Duaw: Data-free universal adversarial watermark against stable diffusion customization. arXiv preprint arXiv:2308.09889

    2023 arXiv

  29. [37]

    A.; Xu, L.; Cuesta-Infante, A.; and Veeramachaneni, K

    Zhang, K. A.; Xu, L.; Cuesta-Infante, A.; and Veeramachaneni, K. 2019. Robust invisible video watermarking with attention. arXiv preprint arXiv:1909.01285

    2019 arXiv

  30. [38]

    A.; Shechtman, E.; and Wang, O

    Zhang, R.; Isola, P.; Efros, A. A.; Shechtman, E.; and Wang, O. 2018. The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recognition, 586--595

    2018

  31. [40]

    Zhao, X.; Zhang, K.; Wang, Y.-X.; and Li, L. 2023 b . Generative autoencoders as watermark attackers: Analyses of vulnerabilities and threats. arXiv preprint arXiv:2306.01953

    2023 arXiv

  32. [41]

    Zhao, Y.; Pang, T.; Du, C.; Yang, X.; Cheung, N.-M.; and Lin, M. 2023 c . A recipe for watermarking diffusion models. arXiv preprint arXiv:2303.10137

    2023 arXiv

  33. [42]

    Zhao, Z.; Duan, J.; Hu, X.; Xu, K.; Wang, C.; Zhang, R.; Du, Z.; Guo, Q.; and Chen, Y. 2023 d . Unlearnable examples for diffusion models: Protect data from unauthorized exploitation. arXiv preprint arXiv:2306.01902

    2023 arXiv

  34. [43]

    Zheng, B.; Liang, C.; Wu, X.; and Liu, Y. 2023. Understanding and improving adversarial attacks on latent diffusion model. arXiv preprint arXiv:2310.04687

    2023

  35. [44]

    Zhu, H.; Wu, W.; Zhu, W.; Jiang, L.; Tang, S.; Zhang, L.; Liu, Z.; and Loy, C. C. 2022. CelebV-HQ: A large-scale video facial attributes dataset. In European conference on computer vision, 650--667. Springer

    2022

  36. [45]

    Zhu, P.; Takahashi, T.; and Kataoka, H. 2024. Watermark-embedded adversarial examples for copyright protection against diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 24420--24430

    2024

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.