Pith. sign in

REVIEW 4 major objections 7 minor 2 cited by

Image Watermarking of Generative Diffusion Models

T0 review · 4 major / 7 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper proposes an end-to-end watermarking scheme that embeds a watermark image directly into the diffusion model's generation process, so every generated image carries an imperceptible, recoverable signature that also identifies the…

desk verdict The learned-autoencoder idea is a real variation on Tree-Ring, but the extraction pipeline as written cannot work and the experimental numbers are unreliable. read the letter →

arxiv 2502.10465 v1 pith:R22GMTKS submitted 2025-02-12 eess.IV cs.CR

Yunzhuo Chen , Jordan Vice , Naveed Akhtar , Nur Al Hasan Haldar , Ajmal Mian This is my paper · ORCID
classification eess.IVcs.CR
keywords diffusionmodelsblindwatermarkinggenerativemodeltracingwatermarkautoencoderimageDDPMDDIMcopyrightprotection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes an end-to-end watermarking scheme for diffusion-based image generators. Instead of altering the output image after generation, it embeds watermark information into the diffusion process itself: an encoder maps a watermark image to a feature map that is added to the Gaussian noise used for reverse diffusion, so the model learns to generate images that carry the watermark. A paired decoder extracts the watermark by running the forward diffusion process on the generated image and mapping the resulting noise back to the watermark. The authors demonstrate near-imperceptible embedding across DDIM and DDPM at three resolutions, robust detection under rotation, blur, texture reduction, and compression, and a two-stage classifier that detects the presence of a watermark and identifies which of four watermarks is present. If the approach holds up, it gives generative-model owners a way to trace any generated image back to its source model.

What carries the argument

The load-bearing object is the watermark autoencoder coupled with the diffusion model through the noise latent. The encoder $E$ converts an arbitrary watermark image $w$ into a feature map $w_T$ of the same spatial size as the diffusion noise; this is added to the Gaussian sample $x_T$ before the reverse (denoising) process, which makes the watermark part of the generative trajectory at every step. The decoder $D$ inverts the process: it maps the forward-diffused noise of a generated image back into a watermark reconstruction. Training is end-to-end with a combined loss that sums the diffusion denoising loss $L_{\text{MD}}$ of Eq. (4) and the watermark reconstruction loss $L_w = \|w - w_R\|^2$, so the generator is forced to embed watermark features without degrading image quality. The image-based classifier networks then read the extracted watermark for presence detection (binary) and type identification (quaternary).

What would settle it

Hold out a test set of images generated by a watermarked model. Run the extraction pipeline of Eq. (9)-(10) on each image with no attack, and measure the similarity between the reconstructed watermark and the watermark actually embedded. The paper's claim predicts near-exact reconstruction on essentially all images; observing a large fraction of reconstructions that are closer to a wrong watermark (or to noise) would falsify the invertibility assumption on which extraction rests.

Watch

Extended reading notes

Core claim

The central claim is that a diffusion model can be trained so that its own generation process embeds an imperceptible, image-based watermark, and that a paired extractor can recover that watermark with high accuracy. The method trains a watermark autoencoder jointly with the diffusion model: the encoder maps a chosen watermark image $w$ to a compact feature map $w_T = E(w)$, which is added to the Gaussian noise sample $x_T$ to form the watermarked starting noise $x^w_T = w_T + x_T$. The reverse diffusion process then generates a watermarked image $x^w$ that visually matches unwatermarked images. At extraction time, the forward diffusion process is applied to $x^w$ to obtain $\tilde{x}^w_T$, and the decoder produces the reconstruction $w_R = D(\tilde{x}^w_T)$. The total loss $L_{\text{Total}} = L_{\text{MD}} + L_w$ balances denoising quality against watermark reconstruction error, and two classifier networks are trained to detect the presence of a watermark and to identify its type, enabling source-model tracing.

Load-bearing premise

The extraction pipeline assumes that running the forward noising process on a generated watermarked image recovers the same watermark-laced noise that the decoder was trained to invert, even though that noising process is stochastic and the paper gives no argument for why this recovery works.

Editorial extensions

If this is right

  • Images produced by a watermarked diffusion model carry a recoverable signature even without any post-processing of the output image.
  • The watermark type identified by the classifier traces the generated image to a specific generator architecture (DDIM or DDPM) and a specific watermark, enabling ownership claims.
  • The method tolerates common image distortions: the reported presence-detection accuracy stays above 88% under rotation, blur, texture reduction, and compression.
  • Because the watermark is a full image rather than a fixed frequency pattern, the scheme can transmit identifying information (such as owner name) and is not vulnerable to attacks that target known Fourier coefficients.
  • The approach is architecture-agnostic across the two tested diffusion families, suggesting it can be dropped into other DDPM-style generators.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A testable extension is to verify the extraction assumption directly: measure the distance between the noise recovered by Eq. (9) and the original $x^w_T$ used at generation; if the forward process is not effectively invertible for the trained decoder, the method may rely on the decoder generalizing from noised images seen during training rather than on true inversion.
  • The reported watermark-type accuracy of 82.51% under no attack leaves room for confusion between the four watermarks; an adversarial user could plausibly exploit this confusion to repudiate the source, so capacity and robustness are in tension.
  • The training sets used here (CIFAR-10, STL-10, Oxford-IIIT Pets) are small relative to modern text-to-image diffusion models; whether the embedding survives the scale and conditioning of a large latent diffusion model is an open question that the paper does not address.
  • If the approach transfers to text-to-image models, it would give a practical audit trail for AI-generated content without modifying the model's sampler or output post-processing.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. The paper proposes an end-to-end watermarking method for DDIM and DDPM diffusion models. A watermark image is encoded by an autoencoder into a latent vector that is added to the initial diffusion noise; the reverse diffusion process then generates a watermarked image. A decoder is trained to reconstruct the watermark from a forward-diffused version of the generated image, and two classifiers are trained to detect watermark presence and identify the watermark type. Experiments are reported at three resolutions (32x32, 96x96, 128x128) on CIFAR-10, STL-10, and Oxford-IIIT Pet, together with attack robustness results and a proposed GWI dataset.

Significance. If the method worked as claimed, it would be a useful contribution to generative-model watermarking: a blind, spatial-domain watermark embedded through the generation process, with a paired extractor and a source-classification mechanism. The GWI dataset is also a potentially useful resource. However, the central extraction mechanism is not justified: Section III-E assumes that a fresh stochastic forward diffusion recovers the watermarked latent that was used at generation time, which is not valid for DDPMs. The evaluation is also in-distribution, with classifiers trained and tested on images from the same generators they verify, and the reported generative-quality metrics are implausibly poor. The reader's stress-test concern about Section III-E is well-founded and is, in my view, the decisive issue.

major comments (4)
  1. [Sec. III-E, Eqs. (9)-(10)] The extraction pipeline is the sole mechanism for watermark recovery, but it is not justified. Eq. (9) applies the forward diffusion process MD_f to the generated image x^w to obtain \tilde{x}^w_T, and Eq. (10) decodes it with D. For a DDPM, MD_f is stochastic: \tilde{x}^w_T is a fresh draw from q(x_T | x^w), not the original x^w_T = E(w) + x_T used in Eq. (6). With the large T typical of DDPMs, q(x_T | x^w) is nearly independent of x^w, so \tilde{x}^w_T contains negligible information about w, and no decoder trained with Eq. (11) can reconstruct w from it. The manuscript never specifies T, the noise schedule \bar{\alpha}_T, or any deterministic inversion mechanism such as DDIM inversion; it also does not explain how D would learn to invert a stochastic process. Without an explicit invertibility mechanism, the reconstructions in Fig. 3 and the classification results in Table III are not supported by the described method.
  2. [Sec. V-C, Table III] The watermark presence detector and type classifier are trained and evaluated on images produced by the same diffusion models whose watermarks they are meant to verify. This is an in-distribution evaluation. A classifier can achieve 100% presence accuracy by learning any systematic difference between watermarked and clean generated images, such as artifacts of the specific generator, resolution, or training data, rather than by detecting the watermark itself. To support the claim that the method distinguishes watermarks and traces source models, the authors must evaluate on held-out generators, including independently trained watermarked and unwatermarked models of the same architecture, and must report training/test splits and standard deviations. As it stands, the 'No-Attack' 100% accuracy is not convincing evidence of watermark recovery.
  3. [Sec. V-A, Table II] The reported FID values (1046.52 at 32x32, 875.39 at 96x96, 811.35 at 128x128) are orders of magnitude larger than typical FID scores for CIFAR-10, STL-10, and Oxford-IIIT Pet, indicating that the generated images are very far from the real data distribution. The text claims that the IS/FID differences are below 5%, but the table itself shows an IS difference of 9.98% at 128x128 and an FID difference of 7.54% at 32x32. These numbers do not support the claim of 'high visual quality' or 'negligible impact on image fidelity'; they instead suggest that the underlying generation model is not well trained. The authors should compare against unwatermarked baselines trained under identical settings and report FID computed on a properly matched reference set.
  4. [Sec. V-D, Table III] Robustness to attacks is evaluated only through classification accuracy; the paper never reports watermark reconstruction error (e.g., MSE, SSIM, or bit accuracy of w_R versus w) under the attack scenarios. Since the central promise is 'precise recovery' of the watermark, attack robustness should be measured on the extracted watermark, not only on a downstream classifier that may be sensitive to attack-induced image artifacts. Moreover, the paper provides no comparisons with existing diffusion watermarking methods such as Tree-Ring (ref. [44]), so the 'highly accurate' and robustness claims are not contextualized. Please add reconstruction metrics under attacks and at least one baseline comparison.
minor comments (7)
  1. [Sec. III-A, Eq. (1)] Eq. (1) is missing the mean term: the distribution should be N(x_t; sqrt(1 - beta_t) x_{t-1}, beta_t I), not N(x_t; sqrt(1 - beta_t), beta_t I). The text also says the reverse process produces x_{t-1}, ..., x_T, which has the indices in the wrong order.
  2. [Sec. III-C] The encoder is described as producing a 'low-dimensional latent representation' w_T, but the architecture description says all convolutional layers maintain a consistent size across the autoencoder. These statements are inconsistent, and no layer counts or architectural details are provided, which prevents reproduction.
  3. [Sec. V-A, Table I] The caption states that the results indicate 'a less than 2% overall change rate', but the table itself reports GLCM Energy differences of 13.63% at 96x96 and 5.26% at 128x128. The text later acknowledges the large GLCM Energy differences, but the caption and the opening sentence of Section V-A are misleading.
  4. [Sec. I and references] Several cited references do not support the claims attached to them. For example, refs. [3], [20], [33], and [48] are cited in Section I as watermarking methods but are not watermarking papers; Table I's 'GLCM Energy [39]' points to an information-entropy reference. The reference list needs a thorough re-check.
  5. [Sec. III-D and Sec. V-B] The training loss in Eq. (8) is written as L_Total = L_MD + L_w, but Section V-B says 'we assigned a higher weight to L_DDIM' and discusses dynamic weighting. The actual weighted loss and the weight values are never given, so the training procedure is not reproducible.
  6. [Sec. IV and Sec. V-D] The GWI dataset is described as a contribution, but no download link or release mechanism is provided. Also, the attack parameters are unspecified: rotation angle, blur kernel size, texture-reduction strength, and compression quality are not given, so the robustness results in Table III cannot be reproduced.
  7. [Sec. V, Table II] Section IV says each resolution category contains 400 watermarked images, but Table II says each resolution dataset includes 200 images and 2 categories. These numbers should be reconciled, and the sample size used for FID/IS should be stated explicitly.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: the watermarking pipeline is a fitted end-to-end composite, not a derivation that reduces to its inputs; the main risks (forward-diffusion inversion, in-sample classifier evaluation) are soundness/validity concerns, not circularity.

full rationale

The paper's derivation chain is not circular by the required standard. The embedding (Eqs. 5-7) defines w_T=E(w), x^w_T=w_T+x_T, and x^w=MD^r(x^w_T); extraction (Eqs. 9-10) defines \tilde{x}^w_T=MD^f(x^w) and w_R=D(\tilde{x}^w_T). Training minimizes L_w=||w-w_R||^2 (Eq. 11) jointly with the diffusion loss. This is a trainable composite objective, not a tautology: the decoder and generator are fitted rather than assumed, and the paper nowhere claims \tilde{x}^w_T=x^w_T by definition. No load-bearing self-citation or imported uniqueness theorem appears; the only author-overlap reference, [2], is a background survey on adversarial attacks and is not load-bearing. The unsupported stochastic-forward-pass inversion in Eq. 9 is a substantive correctness gap: without deterministic inversion (e.g., DDIM inversion) or a small-T justification, the reconstruction pipeline may not recover w_T. Similarly, classification results in Table III appear to be evaluated on the same GWI distribution used to train the detectors, and no train/test split is described, so the 100% presence figure is at risk of being an in-sample fit. These are validity/soundness concerns, however, not circularity: they do not exhibit an equation that is equivalent to its input by construction, nor a fitted parameter renamed as a prediction. Therefore the appropriate circularity score is 0.

Assumptions & free parameters 1 free parameters · 3 assumptions · 0 invented entities

The paper relies on assumptions about diffusion process invertibility and signal preservation that are not proven. The only fitted parameter explicitly mentioned is the loss weight, which is not reported. No new entities are introduced.

free parameters (1)
  • Loss weight for watermark reconstruction loss Lw = not reported
    Section V-B states the weight was adjusted through experiments to balance LMD and Lw, but the specific value(s) are not disclosed. This weight directly affects watermark strength and imperceptibility.
assumptions (3)
  • domain assumption Forward diffusion of a generated watermarked image yields the watermarked noise latent used at generation.
    Eq. (9) in Section III-E assumes the forward process MD_f(xw) recovers xw_T for decoding, but DDPM forward is stochastic and not invertible; this is not justified.
  • domain assumption Watermark features injected into the initial noise survive the full reverse diffusion process without being washed out.
    Section III-B combines w_T with x_T and relies on the reverse process to preserve this signal through all timesteps; no analysis of signal retention is provided.
  • domain assumption The ten image statistics and IS/FID are adequate to certify visual imperceptibility.
    Section V-A relies on these aggregate measures; inadequate variance and implausible FID values undermine the claim.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Image Watermarking of Generative Diffusion Models." pith.science (2026). https://pith.science/paper/R22GMTKS

@misc{pith2026250210465,
  author       = {Pith},
  title        = {Pith review of: Image Watermarking of Generative Diffusion Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/R22GMTKS}},
  note         = {Machine review of arXiv:2502.10465}
}
read the original abstract

Embedding watermarks into the output of generative models is essential for establishing copyright and verifiable ownership over the generated content. Emerging diffusion model watermarking methods either embed watermarks in the frequency domain or offer limited versatility of the watermark patterns in the image space, which allows simplistic detection and removal of the watermarks from the generated content. To address this issue, we propose a watermarking technique that embeds watermark features into the diffusion model itself. Our technique enables training of a paired watermark extractor for a generative model that is learned through an end-to-end process. The extractor forces the generator, during training, to effectively embed versatile, imperceptible watermarks in the generated content while simultaneously ensuring their precise recovery. We demonstrate highly accurate watermark embedding/detection and show that it is also possible to distinguish between different watermarks embedded with our method to differentiate between generative models.

Figures

Figures reproduced from arXiv: 2502.10465 by the authors.

Figure 1
Figure 1. During our model training phase, feature maps extracted from a watermark image are combined with a Gaussian sample to train the diffusion model. Generated images obtained from reverse diffusion process contain watermark features. The Watermark Extractor extracts the watermark features from the image to reconstruct the watermark. against advanced image transformations such as geometric dis￾tortions, sophisticated noi… view at source ↗
Figure 2
Figure 2. The Watermark Generator transforms an image-based watermark w into a watermark feature map wT which serves as a branch input to the diffusion model. It is merged with the output xT of the forward diffusion process. The watermarked noise ‘xwT ’ serves as a new input for the diffusion denoising phase, which enables embedding watermark features into the diffusion model. The trained diffusion model generates images xw0 … view at source ↗
Figure 3
Figure 3. Our blind watermarking mechanism is incorporated into DDIM [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: The Classification Process for Watermark Detection and Identification. The input first passes through a Binary classification network to determine [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: Loss analysis of the end-to-end training process. The Y-axis represents the change in loss, while the X-axis represents the increase in epochs. The [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Visual representation of blind Watermarked-DDIM-Generated images at three resolutions. Row A displays the generated images with embedded [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: Visual representation of blind Watermarked-DDPM-Generated images at three different resolutions. The top row displays the DDPM-generated images [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 8
Figure 8. Figure 8: Comparison of watermark embedding and reconstruction across [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. First-Place Solution to NeurIPS 2024 Invisible Watermark Removal Challenge

    cs.CV 2025-08 conditional novelty 4.0 of 10

    A competition-winning pipeline removes 95.7% of StegaStamp and TreeRing watermarks on the NeurIPS 2024 benchmark by combining VAE fine-tuning, diffusion purification, and translation tricks.

  2. Dynamic watermarks in images generated by diffusion models

    cs.CV 2025-02 reject novelty 4.0 of 10

    The paper claims a two-branch watermarking method that embeds a fixed QR code in a diffusion model's latent process and a dynamic watermark in generated images, enabling source verification.

Reference graph

Works this paper leans on

50 extracted references · 35 canonical work pages · cited by 2 Pith papers

  1. [44]

    Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust

    Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust. arXiv preprint arXiv:2305.20030 , 2023

    arXiv 2023

  2. [1]

    Mesonet: a compact facial video forgery detection network

    Darius Afchar, Vincent Nozick, Junichi Yamagishi, and Isao Echizen. Mesonet: a compact facial video forgery detection network. In 2018 IEEE international workshop on information forensics and security (WIFS), pages 1–7. IEEE, 2018

    2018

  3. [2]

    Threat of adversarial attacks on deep learning in computer vision: A survey

    Naveed Akhtar and Ajmal Mian. Threat of adversarial attacks on deep learning in computer vision: A survey. Ieee Access , 6:14410–14430, 2018. JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 10

    work page 2018

  4. [3]

    Demystifying mmd gans

    Mikołaj Bi ´nkowski, Danica J Sutherland, Michael Arbel, and Arthur Gretton. Demystifying mmd gans. arXiv preprint arXiv:1801.01401 , 2018

    arXiv 2018

  5. [4]

    A survey on generative diffusion model

    Hanqun Cao, Cheng Tan, Zhangyang Gao, Guangyong Chen, Pheng- Ann Heng, and Stan Z Li. A survey on generative diffusion model. arXiv preprint arXiv:2209.02646 , 2022

    arXiv 2022

  6. [5]

    A con- vex model for edge-histogram specification with applications to edge- preserving smoothing

    Kelvin CK Chan, Raymond H Chan, and Mila Nikolova. A con- vex model for edge-histogram specification with applications to edge- preserving smoothing. axioms, 7(3):53, 2018

    work page 2018

  7. [6]

    Digital watermarking and steganography

    Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker. Digital watermarking and steganography . Morgan kaufmann, 2007

    work page 2007

  8. [7]

    Recasting residual-based local descriptors as convolutional neural networks: an application to image forgery detection

    Davide Cozzolino, Giovanni Poggi, and Luisa Verdoliva. Recasting residual-based local descriptors as convolutional neural networks: an application to image forgery detection. In Proceedings of the 5th ACM workshop on information hiding and multimedia security , pages 159– 164, 2017

    work page 2017

Show all 50 references
  1. [8]

    Generative adversarial networks: An overview

    Antonia Creswell, Tom White, Vincent Dumoulin, Kai Arulkumaran, Biswa Sengupta, and Anil A Bharath. Generative adversarial networks: An overview. IEEE signal processing magazine , 35(1):53–65, 2018

    2018

  2. [9]

    Image sharpness measure for blurred images in frequency domain

    Kanjar De and V Masilamani. Image sharpness measure for blurred images in frequency domain. Procedia Engineering, 64:149–158, 2013

    2013

  3. [10]

    Naturalness and image quality: saturation and lightness variation in color images of natural scenes

    Huib de Ridder. Naturalness and image quality: saturation and lightness variation in color images of natural scenes. Journal of imaging science and technology, 40(6):487–493, 1996

    1996

  4. [11]

    The contourlet transform: an efficient directional multiresolution image representation

    Minh N Do and Martin Vetterli. The contourlet transform: an efficient directional multiresolution image representation. volume 14, pages 2091–2106. IEEE, 2005

    2005

  5. [12]

    Tutorial on variational autoencoders

    Carl Doersch. Tutorial on variational autoencoders. arXiv preprint arXiv:1606.05908, 2016

    2016 arXiv

  6. [13]

    Blind watermarking applied to image authentication

    Joachim J Eggers and Bernd Girod. Blind watermarking applied to image authentication. In 2001 IEEE International Conference on Acous- tics, Speech, and Signal Processing. Proceedings (Cat. No. 01CH37221), volume 3, pages 1977–1980. IEEE, 2001

    2001

  7. [14]

    A cyber defense system against phishing attacks with deep learning game theory and lstm-cnn with african vulture optimiza- tion algorithm (avoa)

    Mustafa Ahmed Elberri, ¨Umit Tokes ¸er, Javad Rahebi, and Jose Manuel Lopez-Guede. A cyber defense system against phishing attacks with deep learning game theory and lstm-cnn with african vulture optimiza- tion algorithm (avoa). International Journal of Information Security , ...

    2024

  8. [15]

    Leveraging frequency analysis for deep fake image recognition

    Joel Frank, Thorsten Eisenhofer, Lea Sch ¨onherr, Asja Fischer, Dorothea Kolossa, and Thorsten Holz. Leveraging frequency analysis for deep fake image recognition. In International conference on machine learn- ing, pages 3247–3258. PMLR, 2020

    2020

  9. [16]

    On the application lbp texture descriptors and its variants for no-reference image quality assessment

    Pedro Garcia Freitas, Lu ´ısa Peixoto Da Eira, Samuel Soares Santos, and Mylene Christine Queiroz de Farias. On the application lbp texture descriptors and its variants for no-reference image quality assessment. Journal of Imaging , 4(10), 2018

    2018

  10. [17]

    Practical markov chain monte carlo

    Charles J Geyer. Practical markov chain monte carlo. Statistical science, pages 473–483, 1992

    1992

  11. [18]

    Pggan: Improve password cover rate using the controller

    Xiaozhou Guo, Yi Liu, Kaijun Tan, Min Jin, and Huaxiang Lu. Pggan: Improve password cover rate using the controller. In Journal of Physics: Conference Series, volume 1856, page 012012. IOP Publishing, 2021

    2021

  12. [19]

    Laplacian score for feature selection

    Xiaofei He, Deng Cai, and Partha Niyogi. Laplacian score for feature selection. Advances in neural information processing systems , 18, 2005

    2005

  13. [20]

    Gans trained by a two time-scale update rule converge to a local nash equilibrium

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems , 30, 2017

    2017

  14. [21]

    Denoising diffusion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. NIPS, 33:6840–6851, 2020

    2020

  15. [22]

    Robust texture-aware local adaptive image watermarking with perceptual guarantee

    Ying Huang, Hu Guan, Jie Liu, Shuwu Zhang, Baoning Niu, and Guix- uan Zhang. Robust texture-aware local adaptive image watermarking with perceptual guarantee. IEEE Transactions on Circuits and Systems for Video Technology, 33(9):4660–4674, 2023

    2023

  16. [23]

    Learning multiple layers of features from tiny images, cifar-10 and cifar-100 datasets, 2009

    Alex Krizhevsky. Learning multiple layers of features from tiny images, cifar-10 and cifar-100 datasets, 2009. Accessed: 2024-08-08

    2009

  17. [24]

    Robust image watermarking using local invariant features

    Hae-Yeoun Lee, Hyungshin Kim, and Heung-Kyu Lee. Robust image watermarking using local invariant features. Optical Engineering , 45(3):037002–037002, 2006

    2006

  18. [25]

    Stl-10 - image recognition dataset, 2017

    Jessica Li. Stl-10 - image recognition dataset, 2017. Accessed: 2024- 08-08

    2017

  19. [26]

    Adm: Accelerated diffusion model via estimated priors for robust motion prediction under uncer- tainties

    Jiahui Li, Tianle Shen, Zekai Gu, Jiawei Sun, Chengran Yuan, Yuhang Han, Shuo Sun, and Marcelo H Ang Jr. Adm: Accelerated diffusion model via estimated priors for robust motion prediction under uncer- tainties. arXiv preprint arXiv:2405.00797 , 2024

    2024 arXiv

  20. [27]

    Pseudo numerical meth- ods for diffusion models on manifolds

    Luping Liu, Yi Ren, Zhijie Lin, and Zhou Zhao. Pseudo numerical meth- ods for diffusion models on manifolds. arXiv preprint arXiv:2202.09778, 2022

    2022 arXiv

  21. [28]

    Blind dual watermarking for color images’ authentication and copyright protection

    Xiao-Long Liu, Chia-Chen Lin, and Shyan-Ming Yuan. Blind dual watermarking for color images’ authentication and copyright protection. IEEE Transactions on Circuits and Systems for Video Technology , 28(5):1047–1061, 2018

    2018

  22. [29]

    Leveraging optimization for adaptive attacks on image watermarks

    Nils Lukas, Abdulrahman Diaa, Lucas Fenaux, and Florian Kerschbaum. Leveraging optimization for adaptive attacks on image watermarks. arXiv preprint arXiv:2309.16952 , 2023

    2023 arXiv

  23. [30]

    Improved denoising diffusion probabilistic models

    Alexander Quinn Nichol and Prafulla Dhariwal. Improved denoising diffusion probabilistic models. In International Conference on Machine Learning, pages 8162–8171. PMLR, 2021

    2021

  24. [31]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj¨orn Ommer. High-resolution image synthesis with latent diffusion models. In CVPR, pages 10684–10695, 2022

    2022

  25. [32]

    Faceforensics++: Learning to detect manipulated facial images

    Andreas Rossler, Davide Cozzolino, Luisa Verdoliva, Christian Riess, Justus Thies, and Matthias Nießner. Faceforensics++: Learning to detect manipulated facial images. In Proceedings of the IEEE/CVF international conference on computer vision , pages 1–11, 2019

    2019

  26. [33]

    Improved techniques for training gans

    Tim Salimans, Ian Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen. Improved techniques for training gans. Advances in neural information processing systems , 29, 2016

    2016

  27. [34]

    Gray level co-occurrence matrices: generalisation and some new features

    Bino Sebastian V , A Unnikrishnan, and Kannan Balakrishnan. Gray level co-occurrence matrices: generalisation and some new features. arXiv preprint arXiv:1205.4831, 2012

    2012 arXiv

  28. [35]

    Denoising diffusion implicit models

    Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502 , 2020

    2010 arXiv

  29. [36]

    Density based smart traffic control system using canny edge detection algorithm for congregating traffic information

    Taqi Tahmid and Eklas Hossain. Density based smart traffic control system using canny edge detection algorithm for congregating traffic information. In 2017 3rd International Conference on Electrical Infor- mation and Communication Technology (EICT), pages 1–5. IEEE, 2017

    2017

  30. [37]

    The oxford-iiit pet dataset, 2021

    Tanlikesmath. The oxford-iiit pet dataset, 2021. Accessed: 2024-08-08

    2021

  31. [38]

    A distributed and cooperative signature-based intrusion detection system framework for multi-channel man-in-the-middle attacks against pro- tected wi-fi networks

    Manesh Thankappan, Helena Rif `a-Pous, and Carles Garrigues. A distributed and cooperative signature-based intrusion detection system framework for multi-channel man-in-the-middle attacks against pro- tected wi-fi networks. International Journal of Information Security , pages...

    2024

  32. [39]

    Information entropy measure for evaluation of image quality

    Du-Yih Tsai, Yongbum Lee, and Eri Matsuyama. Information entropy measure for evaluation of image quality. Journal of digital imaging , 21:338–347, 2008

    2008

  33. [40]

    Neural discrete representation learning

    Aaron Van Den Oord, Oriol Vinyals, et al. Neural discrete representation learning. Advances in neural information processing systems , 30, 2017

    2017

  34. [41]

    Robust image watermarking with synchronization using template enhanced-extracted network

    Ke Wang, Shaowu Wu, Xiaolin Yin, Wei Lu, Xiangyang Luo, and Rui Yang. Robust image watermarking with synchronization using template enhanced-extracted network. IEEE Transactions on Circuits and Systems for Video Technology, 2024

    2024

  35. [42]

    Image quality assessment: from error visibility to structural similarity

    Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing , 13(4):600–612, 2004

    2004

  36. [43]

    A markov- transition model for cascading failures in power grids

    Zhifang Wang, Anna Scaglione, and Robert J Thomas. A markov- transition model for cascading failures in power grids. In 2012 45th Hawaii International Conference on System Sciences, pages 2115–2124. IEEE, 2012

    2012

  37. [45]

    Watermarking neural networks with watermarked images

    Hanzhou Wu, Gen Liu, Yuwei Yao, and Xinpeng Zhang. Watermarking neural networks with watermarked images. IEEE Transactions on Circuits and Systems for Video Technology , 31(7):2591–2605, 2021

    2021

  38. [46]

    Lsun: Construction of a large-scale image dataset using deep learning with humans in the loop

    Fisher Yu, Ari Seff, Yinda Zhang, Shuran Song, Thomas Funkhouser, and Jianxiong Xiao. Lsun: Construction of a large-scale image dataset using deep learning with humans in the loop. arXiv preprint arXiv:1506.03365, 2015

    2015 arXiv

  39. [47]

    A study for texture feature extraction of high-resolution satellite images based on a direction measure and gray level co-occurrence matrix fusion algorithm

    Xin Zhang, Jintian Cui, Weisheng Wang, and Chao Lin. A study for texture feature extraction of high-resolution satellite images based on a direction measure and gray level co-occurrence matrix fusion algorithm. Sensors, 17(7):1474, 2017

    2017

  40. [48]

    Hype: human-eye perceptual evaluation of generative models

    Sharon Zhou, Mitchell Gordon, Ranjay Krishna, Austin Narcomey, Durim Morina, and Michael S Bernstein. Hype: human-eye perceptual evaluation of generative models. 2019

    2019

  41. [49]

    Hidden: Hiding data with deep networks

    Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In Proceedings of the European conference on computer vision (ECCV) , pages 657–672, 2018

    2018

  42. [50]

    Robust histogram shape-based method for image watermarking

    Tianrui Zong, Yong Xiang, Iynkaran Natgunanathan, Song Guo, Wanlei Zhou, and Gleb Beliakov. Robust histogram shape-based method for image watermarking. IEEE Transactions on Circuits and Systems for Video Technology, 25(5):717–729, 2015. IX. B IOGRAPHY SECTION JOURNAL OF LATEX ...

    2015

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.