Pith. sign in

REVIEW 4 major objections 6 minor 42 references

Training-Free Watermarking for Autoregressive Image Generation

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read IndexMark embeds an invisible, verifiable watermark into autoregressive images by replacing each generated index with a similar green partner—no retraining required.

desk verdict A useful adaptation of red-green watermarking to autoregressive image generators, but the 'training-free' label and the unvalidated 50% null both need fixing before the verification claims hold up. read the letter →

arxiv 2505.14673 v1 pith:6EEJ7DAR submitted 2025-05-20 cs.CV cs.AIcs.CR

Yu Tong , Zihao Pan , Shuai Yang , Kaiyang Zhou This is my paper
classification cs.CVcs.AIcs.CR
keywords training-freewatermarkingautoregressiveimagegenerationcodebookredundancyred-greenindexwatermarkVQ-VAEmatch-then-replaceprovenanceLlamaGen
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

IndexMark claims to be the first training-free watermarking method for autoregressive image generation. It hides an invisible watermark by exploiting codebook redundancy: similar indices are paired and split into red and green lists, and during generation red indices are swapped for green partners when the model's confidence gap is small. Verification decides by comparing the green-index rate against a confidence interval built from a 50% null hypothesis. The authors report that image quality and robustness across cropping, noise, blur, erasing, color jitter, and JPEG compression outperform diffusion-based and post-hoc baselines.

What carries the argument

The load-bearing mechanism is the match-then-replace pipeline built on codebook redundancy. Index pairs are obtained by maximum weight perfect matching (top-K pruning plus the Blossom algorithm); each pair is randomly split into red and green members; replacement is gated by a relative-confidence quantile so only low-risk swaps are made. Verification uses the green-index rate as a Bernoulli statistic with a central-limit confidence interval, refined by an Index Encoder for index reconstruction and a 64-offset traversal for crop alignment.

What would settle it

Take the same autoregressive model, disable watermarking, generate a few thousand images, reconstruct indices with the Index Encoder, and plot the green-index rate; if the mean departs from 0.5 by more than $z_{\beta/2}/(2\sqrt{N_{\text{Idx}}})$ or the variance exceeds the Bernoulli value, the 99.9% threshold would flag unwatermarked images at higher than $1-\beta$.

Watch

Extended reading notes

Core claim

The central discovery is that the discrete token stream of an autoregressive image generator can itself carry a watermark, with no training or architecture change, because the codebook contains many near-duplicate vectors. IndexMark solves a maximum weight perfect matching over codebook vectors by cosine similarity, randomly assigns one member of each pair to red and one to green, then replaces red indices with green partners only when the relative confidence $\log(P(\text{Idx}_k)/P(\text{Idx}'_k))$ is below a quantile threshold. The green-index rate in the resulting image approaches a target fraction that is statistically distinguishable from the 50% baseline of an unwatermarked image. To make verification robust under perturbations, a trained Index Encoder reconstructs indices more accurately than the original VQ-VAE encoder, and a traversal over candidate top-left positions handles cropping.

Load-bearing premise

The whole verification scheme assumes that an unwatermarked image's green-index rate is 50% with independent tokens, so any higher rate is statistically impossible by chance; if the model's token distribution is skewed within a pair, the advertised false-positive control no longer holds.

Editorial extensions

If this is right

  • Any codebook-based autoregressive image generator can be watermarked without fine-tuning or extra inference modules, as long as its codebook has redundant similar vectors.
  • Image fidelity stays near the unwatermarked output: PSNR around 24 dB and FID/CLIP scores comparable or better, because only visually similar indices are swapped.
  • The watermark survives JPEG, Gaussian blur, Gaussian noise, color jitter, random erasing, and 75% cropping at the reported thresholds, with average verification accuracy above 0.99 on tested settings.
  • The $2^{N/2}$ possible red-green assignments give model owners many fingerprint IDs for user-level tracing.
  • Cropping robustness comes from enumerating the first local block's 64 offsets, so a cropped image is verified when any aligned window exceeds the green-rate threshold.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the scheme only needs similar tokens, not images, the same red-green pairing could be transferred to other discrete generative modalities (audio, video, or tokenized 3D content) whose codebooks are redundant.
  • The 50% null model treats each generated index as an independent fair coin; adjacent image tokens are spatially correlated, so real unwatermarked green-rate variance will likely exceed the binomial bound, meaning the confidence level should be calibrated per model rather than taken as a fixed 99.9%.
  • A stronger variant could choose green partners by semantic similarity rather than raw cosine similarity, trading a small amount of invisibility for resilience to semantic-preserving attacks like super-resolution or recoloring.
  • Testable prediction: applying IndexMark to a model with heavily skewed unigram token frequencies (e.g., a model with a few dominant codebook entries) will inflate the false-positive rate at the advertised threshold unless the pair construction balances per-pair usage.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The manuscript introduces IndexMark, a watermarking framework for autoregressive image generation. It pairs similar codebook indices via maximum-weight perfect matching, randomly assigns one red and one green index per pair, and during generation replaces red indices with green partners according to a relative-confidence quantile, so that watermarked images contain an elevated proportion of green indices. Verification computes the green-index rate, optionally using a retrained Index Encoder for more accurate index reconstruction, and compares it with a threshold derived from a normal-approximation confidence interval around 0.5; for cropped images, it enumerates 64 candidate top-left shifts and accepts if any yields a green rate above threshold. Experiments on LlamaGen with MS-COCO and ImageNet compare against DwtDct, DwtDctSvd, RivaGAN, Tree-Ring, and ROBIN, reporting image-quality metrics and attack robustness.

Significance. The core idea — exploiting codebook redundancy through pairing and match-then-replace to embed a statistical watermark in autoregressive image generation — is novel, well-motivated, and potentially practical for LlamaGen-style models. The released code and the detailed appendices are strengths. However, two central pillars of the claim are not yet supported: the 'training-free' characterization is contradicted by the retrained Index Encoder, and the 50% green-rate null model underlying all verification thresholds is not validated empirically. The reported PSNR/SSIM values also contradict the stated imperceptibility. With those points addressed, the method could be a useful contribution; as presented, the claims outrun the evidence.

major comments (4)
  1. [§3.2 (Index Encoder), §4 (Implementation Details), Contribution 1] The title, abstract, and contribution 1 state that IndexMark is training-free and requires 'no additional fine-tuning or training.' However, Section 3.2 retrains an Index Encoder by optimizing Eq. (5), and Section 4 states that this encoder is pre-trained on MS-COCO-2017 and ImageNet-1k with an Adam optimizer and learning rate 1e-5. The reported verification accuracy in Table 1 is obtained with this trained module; Table 3 shows that removing it lowers some attack accuracies (e.g., Crop from 0.998 to 0.917 on MSCOCO 256×256). The claim 'training-free watermarking framework' is therefore not supported for the system as evaluated. Please either reposition the Index Encoder as an optional, separately trained component and present the training-free configuration as the primary result, or revise the claim.
  2. [§3.2, Eq. (4)] The verification threshold is derived from the null model that an unwatermarked image's green-index count is Binomial(NIdx, 0.5). The text justifies p = 0.5 by 'red and green indices are randomly assigned,' but this only yields an expected green rate of 0.5 averaged over random assignments. For the single fixed red/green assignment used at verification time, the null green rate is the probability that the AR model emits indices on the green side of each pair; because pairs are formed by cosine similarity, the two members of a pair need not have equal marginal probabilities, and the AR model's conditional dependencies further invalidate the independent-Bernoulli assumption. The paper reports no false-positive rate on unwatermarked generated images, so the claimed 99.9% confidence level (Appendix C.2 thresholds of 0.615 and 0.60) is unsupported. This is load-bearing because every detection threshold and all reported ACC values inherit the null model. Please provide empirical null distributions over unwatermarked images from the same generator and either calibrate thresholds to the measured distribution or replace Eq. (4) with a valid test.
  3. [Table 1, Abstract, §4.1] The abstract and Section 1 claim 'negligible visual differences' and 'imperceptible' embedding, but Table 1 reports PSNR 23.54 and SSIM 0.838 for IndexMark on MSCOCO 256×256 (and similar values elsewhere), which are far below the post-processing baselines (e.g., PSNR ≥ 37) and indicate clearly visible distortion. The statement in Section 4.1 that the approach has 'much less image quality degradation compared to watermark-free generations' is not compatible with the metric definitions, since the watermark-free row has PSNR ∞ and SSIM 1.0. Please temper the imperceptibility claims, add a perceptual study or at least a discussion of what the PSNR/SSIM values imply, and explain why the FID for watermarked images is lower than for unwatermarked ones.
  4. [§3.2 (Cropped Image Watermark Verification), Appendix B.3, Table 1] The cropping-robust verification accepts a cropped image if any of the 64 enumerations of the top-left corner yields a green rate above the threshold. This is a multiple-comparison procedure: under the null hypothesis, the maximum of 64 correlated statistics is far more likely to exceed a threshold calibrated for a single test. The crop-specific thresholds in Appendix C.2 (0.65 or 0.7) are chosen ad hoc, and no false-positive analysis for unwatermarked cropped images is given. Since the Crop column is a major part of the robustness claim in Table 1, please report the empirical false-positive rate under cropping for unwatermarked images and adjust thresholds or apply a multiple-testing correction.
minor comments (6)
  1. [Appendix C.2] The phrase '99.9% confidence level' is ambiguous; Eq. (4) uses β, and the manuscript should state the zβ/2 values used for each threshold (0.615, 0.60, 0.65, 0.7).
  2. [§4 (Model and Datasets)] There is a typo: 'we generat images' should be 'we generate images'.
  3. [References] References [25] and [26] are duplicates of the same LlamaGen paper; please merge them.
  4. [Figure 3] The 'index pair distribution' plot has no axis labels or caption explaining what quantity is plotted; please add them.
  5. [§3.1] The phrase 'the classification probability of an index predicted by the autoregressive model' should clarify whether this is the softmax probability of the sampled token under the model's predictive distribution; the distinction matters for the confidence-guided replacement rule.
  6. [Table 1] The 'Avg' column mixes attack types of different difficulty and includes 'Crop,' whose handling differs from the other attacks (traversal with a relaxed threshold); consider reporting a separate mean without Crop or adding a footnote.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: IndexMark's embedding and verification are operationally linked by construction, not by an equivalence or fitted-input rename, and no load-bearing self-citation appears.

full rationale

The central claim is that replacing autoregressively generated red indices with paired green indices raises the green-index rate, and that this rate can be statistically verified. This is a direct, operational embedding mechanism rather than a derived prediction that reduces to its inputs: the match-then-replace procedure (Section 3.1) actually alters the token sequence, and verification (Section 3.2) measures the resulting green-index proportion. The threshold in Eq. (4) is a standard normal-approximation confidence interval around a 50% null rate; even if the null-rate assumption is empirically questionable for skewed codebook distributions, that is a correctness risk, not circularity, because the threshold is not fitted from the watermarked data and then relabeled as a prediction. The maximum-weight perfect matching is solved with the external Blossom algorithm, and the Index Encoder is trained with the explicit reconstruction losses in Eq. (5), neither of which smuggles the verification outcome into the method's definition. The robustness comparisons are against external post-processing and diffusion baselines using standard metrics, so the reported accuracies are not equivalent to the paper's own assumptions. No argument in the paper depends on a uniqueness theorem or load-bearing self-citation from the authors' prior work. Thus the derivation chain is self-contained, and any weaknesses concern empirical validity of the null model, not circularity.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The central claim rests on a small set of hand-chosen hyperparameters (replacement quantile, verification thresholds) and on three assumptions: the 50% green-rate null, codebook redundancy, and the normal approximation. No new physical or conceptual entities are introduced; the Index Encoder is a trained auxiliary network, not a postulated entity.

free parameters (2)
  • Replacement quantile (watermark strength) = Not specified in main text; class-conditioned uses full-green (all red indices replaced)
    Controls the fraction of red indices replaced by green indices. The paper does not report the value used for the main text-to-image results in Table 1, making the quality-strength trade-off irreproducible.
  • Verification green-rate thresholds = 0.615 at 256/384, 0.60 at 512; crop thresholds 0.7 (256/384) and 0.65 (512)
    Chosen by hand near the 99.9% and 99.99% confidence intervals. They set the operating point and directly determine the false-positive rate, but are not fitted to the data.
assumptions (3)
  • domain assumption Unwatermarked images have a green index rate of approximately 50%
    The statistical test in Eq. (4) models each generated index as an independent Bernoulli trial with p=0.5. This assumes the red-green assignment is independent of the model's token frequency distribution. The paper does not empirically validate this against the actual token distribution of LlamaGen; skewed frequencies would bias the expected green rate and mis-calibrate the threshold.
  • domain assumption Codebook redundancy: replacing an index with a paired similar index yields visually similar image content
    The match-then-replace embedding rests on this redundancy, referenced from prior autoregressive image generation literature [11,14]. The paper does not quantify the perceptual cost per replaced token beyond aggregate PSNR, SSIM, and CLIP scores.
  • standard math Central Limit Theorem / normal approximation for the green-index proportion
    Used in Eq. (4) to build the confidence interval for the decision threshold. Standard and valid when NIdx is large and tokens are independent, which is itself an approximation that the paper does not verify for autoregressive token sequences.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Training-Free Watermarking for Autoregressive Image Generation." pith.science (2026). https://pith.science/paper/6EEJ7DAR

@misc{pith2026250514673,
  author       = {Pith},
  title        = {Pith review of: Training-Free Watermarking for Autoregressive Image Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6EEJ7DAR}},
  note         = {Machine review of arXiv:2505.14673}
}
read the original abstract

Invisible image watermarking can protect image ownership and prevent malicious misuse of visual generative models. However, existing generative watermarking methods are mainly designed for diffusion models while watermarking for autoregressive image generation models remains largely underexplored. We propose IndexMark, a training-free watermarking framework for autoregressive image generation models. IndexMark is inspired by the redundancy property of the codebook: replacing autoregressively generated indices with similar indices produces negligible visual differences. The core component in IndexMark is a simple yet effective match-then-replace method, which carefully selects watermark tokens from the codebook based on token similarity, and promotes the use of watermark tokens through token replacement, thereby embedding the watermark without affecting the image quality. Watermark verification is achieved by calculating the proportion of watermark tokens in generated images, with precision further improved by an Index Encoder. Furthermore, we introduce an auxiliary validation scheme to enhance robustness against cropping attacks. Experiments demonstrate that IndexMark achieves state-of-the-art performance in terms of image quality and verification accuracy, and exhibits robustness against various perturbations, including cropping, noises, Gaussian blur, random erasing, color jittering, and JPEG compression.

Figures

Figures reproduced from arXiv: 2505.14673 by the authors.

Figure 1
Figure 1. Watermark embedding by index replacement to attain a higher proportion of watermark tokens (green index). We believe leveraging the characteristics of the autore￾gressive image generation models is the key to the design of an effective watermarking strategy. Recent research in autoregressive image generation models has identified a notable redundancy issue in their codebooks [14, 11]: a large number of vectors are a… view at source ↗
Figure 2
Figure 2. Watermark embedding and verification of IndexMark. During autoregressive index genera [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Index pair distribution of one hundred generated images. where k represents the relative confidence of the k-th index pair. We achieve controllable watermark strength by setting a distribu￾tion quantile, with the relative confidence distribution illustrated in [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (9 more)
Figure 4
Figure 4. Figure 4: Training of Index Encoder. The Encoder, Codebook, and Decoder are frozen while the [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: ROBIN vs. IndexMark. ROBIN embeds watermarks during the intermediate diffusion state, [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Ablation results on confidence-guided index replacement and Index Encoder. [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: Images showing the variation of training loss, index reconstruction rate, and green index [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 8
Figure 8. Figure 8: Generated images under different watermark strengths. [PITH_FULL_IMAGE:figures/full_fig_p009_8.png]
Figure 9
Figure 9. Figure 9: Visualization of the traversal process for watermark verification on the cropped image. [PITH_FULL_IMAGE:figures/full_fig_p015_9.png]
Figure 10
Figure 10. Figure 10: GreenGen vs. IndexMark. GreenGen generates autoregressive images by removing [PITH_FULL_IMAGE:figures/full_fig_p016_10.png]
Figure 11
Figure 11. Figure 11: More qualitative comparison results between non-watermarked images and IndexMark [PITH_FULL_IMAGE:figures/full_fig_p018_11.png]
Figure 12
Figure 12. Figure 12: More qualitative comparison results between non-watermarked images and IndexMark [PITH_FULL_IMAGE:figures/full_fig_p019_12.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

42 extracted references · 12 canonical work pages

  1. [1]

    Combined dwt-dct digital image watermarking.Journal of computer science, 3(9):740–746, 2007

    Ali Al-Haj. Combined dwt-dct digital image watermarking.Journal of computer science, 3(9):740–746, 2007

    2007

  2. [2]

    Language models are few-shot learners.Advances in neural information processing systems, 33:1877–1901, 2020

    Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners.Advances in neural information processing systems, 33:1877–1901, 2020

    1901

  3. [3]

    The malicious use of artificial intelligence: Forecasting, prevention, and mitigation.arXiv preprint arXiv:1802.07228, 2018

    Miles Brundage, Shahar Avin, Jack Clark, Helen Toner, Peter Eckersley, Ben Garfinkel, Allan Dafoe, Paul Scharre, Thomas Zeitzoff, Bobby Filar, et al. The malicious use of artificial intelligence: Forecasting, prevention, and mitigation.arXiv preprint arXiv:1802.07228, 2018

    arXiv 2018

  4. [4]

    Reproducible scaling laws for contrastive language-image learning

    Mehdi Cherti, Romain Beaumont, Ross Wightman, Mitchell Wortsman, Gabriel Ilharco, Cade Gordon, Christoph Schuhmann, Ludwig Schmidt, and Jenia Jitsev. Reproducible scaling laws for contrastive language-image learning. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2818–2829, 2023

    2023

  5. [5]

    Morgan kaufmann, 2007

    Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker.Digital watermarking and steganography. Morgan kaufmann, 2007

    2007

  6. [6]

    Imagenet: A large- scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large- scale hierarchical image database. In2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009

    2009

  7. [7]

    Paths, trees, and flowers.Canadian Journal of mathematics, 17:449–467, 1965

    Jack Edmonds. Paths, trees, and flowers.Canadian Journal of mathematics, 17:449–467, 1965

    1965

  8. [8]

    Taming transformers for high-resolution image synthesis

    Patrick Esser, Robin Rombach, and Bjorn Ommer. Taming transformers for high-resolution image synthesis. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 12873–12883, 2021

    2021

Show all 42 references
  1. [9]

    John Wiley & Sons, 1991

    William Feller.An introduction to probability theory and its applications, V olume 2, volume 2. John Wiley & Sons, 1991

    1991

  2. [10]

    The sta- ble signature: Rooting watermarks in latent diffusion models

    Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The sta- ble signature: Rooting watermarks in latent diffusion models. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 22466–22477, 2023

    2023

  3. [11]

    Improving autoregressive image generation through coarse-to-fine token prediction.arXiv preprint arXiv:2503.16194, 2025

    Ziyao Guo, Kaipeng Zhang, and Michael Qizhe Shieh. Improving autoregressive image generation through coarse-to-fine token prediction.arXiv preprint arXiv:2503.16194, 2025

    2025 arXiv

  4. [12]

    Gans trained by a two time-scale update rule converge to a local nash equilibrium.Advances in neural information processing systems, 30, 2017

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium.Advances in neural information processing systems, 30, 2017

    2017

  5. [13]

    Denoising diffusion probabilistic models.Advances in neural information processing systems, 33:6840–6851, 2020

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models.Advances in neural information processing systems, 33:6840–6851, 2020

    2020

  6. [14]

    Improving autoregressive visual generation with cluster-oriented token prediction.arXiv preprint arXiv:2501.00880, 2025

    Teng Hu, Jiangning Zhang, Ran Yi, Jieyu Weng, Yabiao Wang, Xianfang Zeng, Zhucun Xue, and Lizhuang Ma. Improving autoregressive visual generation with cluster-oriented token prediction.arXiv preprint arXiv:2501.00880, 2025

    2025 arXiv

  7. [15]

    Robin: Robust and invisible watermarks for diffusion models with adversarial optimization.Advances in Neural Information Processing Systems, 37:3937–3963, 2024

    Huayang Huang, Yu Wu, and Qian Wang. Robin: Robust and invisible watermarks for diffusion models with adversarial optimization.Advances in Neural Information Processing Systems, 37:3937–3963, 2024

    2024

  8. [16]

    White house rolls out plan to promote ethical ai, 2023

    Makena Kelly. White house rolls out plan to promote ethical ai, 2023

    2023

  9. [17]

    Adam: A method for stochastic optimization.arXiv preprint arXiv:1412.6980, 2014

    Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization.arXiv preprint arXiv:1412.6980, 2014

    2014 arXiv

  10. [18]

    A watermark for large language models

    John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. InInternational Conference on Machine Learning, pages 17061–17084. PMLR, 2023. 10

    2023

  11. [19]

    Microsoft coco: Common objects in context

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. InComputer vision–ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, proceedings,...

    2014

  12. [20]

    Open- magvit2: An open-source project toward democratizing auto-regressive visual generation.arXiv preprint arXiv:2409.04410, 2024

    Zhuoyan Luo, Fengyuan Shi, Yixiao Ge, Yujiu Yang, Limin Wang, and Ying Shan. Open- magvit2: An open-source project toward democratizing auto-regressive visual generation.arXiv preprint arXiv:2409.04410, 2024

    2024 arXiv

  13. [21]

    Dwt- dct-svd based watermarking

    KA Navas, Mathews Cheriyan Ajay, M Lekshmi, Tampy S Archana, and M Sasikumar. Dwt- dct-svd based watermarking. In2008 3rd international conference on communication systems software and middleware and workshops (COMSWARE’08), pages 271–274. IEEE, 2008

    2008

  14. [22]

    The maximum weight perfect matching problem for complete weighted graphs is in pc

    Constantine NK Osiakwan and Selim G Akl. The maximum weight perfect matching problem for complete weighted graphs is in pc. InProceedings of the Second IEEE Symposium on Parallel and Distributed Processing 1990, pages 880–887. IEEE, 1990

    1990

  15. [23]

    Learning transferable visual models from natural language supervision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. InInternational conference on machine learning, pag...

    2021

  16. [24]

    Lawa: Using latent space for in-generation image watermarking

    Ahmad Rezaei, Mohammad Akbari, Saeed Ranjbar Alvar, Arezou Fatemi, and Yong Zhang. Lawa: Using latent space for in-generation image watermarking. InEuropean Conference on Computer Vision, pages 118–136. Springer, 2024

    2024

  17. [26]

    Autoregressive model beats diffusion: Llama for scalable image generation.arXiv preprint arXiv:2406.06525, 2024

    Peize Sun, Yi Jiang, Shoufa Chen, Shilong Zhang, Bingyue Peng, Ping Luo, and Zehuan Yuan. Autoregressive model beats diffusion: Llama for scalable image generation.arXiv preprint arXiv:2406.06525, 2024

    2024 arXiv

  18. [27]

    Visual autoregressive modeling: Scalable image generation via next-scale prediction.Advances in neural information processing systems, 37:84839–84865, 2024

    Keyu Tian, Yi Jiang, Zehuan Yuan, Bingyue Peng, and Liwei Wang. Visual autoregressive modeling: Scalable image generation via next-scale prediction.Advances in neural information processing systems, 37:84839–84865, 2024

    2024

  19. [28]

    Con- ditional image generation with pixelcnn decoders.Advances in neural information processing systems, 29, 2016

    Aaron Van den Oord, Nal Kalchbrenner, Lasse Espeholt, Oriol Vinyals, Alex Graves, et al. Con- ditional image generation with pixelcnn decoders.Advances in neural information processing systems, 29, 2016

    2016

  20. [29]

    Pixel recurrent neural networks

    Aäron Van Den Oord, Nal Kalchbrenner, and Koray Kavukcuoglu. Pixel recurrent neural networks. InInternational conference on machine learning, pages 1747–1756. PMLR, 2016

    2016

  21. [30]

    Neural discrete representation learning.Advances in neural information processing systems, 30, 2017

    Aaron Van Den Oord, Oriol Vinyals, et al. Neural discrete representation learning.Advances in neural information processing systems, 30, 2017

    2017

  22. [31]

    Attention is all you need.Advances in neural information processing systems, 30, 2017

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need.Advances in neural information processing systems, 30, 2017

    2017

  23. [32]

    An online propaganda campaign used ai-generated headshots to create fake journalists.V erge

    James Vincent. An online propaganda campaign used ai-generated headshots to create fake journalists.V erge. com, 2020

    2020

  24. [33]

    Image quality assessment: from error visibility to structural similarity.IEEE transactions on image processing, 13(4):600– 612, 2004

    Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assessment: from error visibility to structural similarity.IEEE transactions on image processing, 13(4):600– 612, 2004

    2004

  25. [34]

    Safe-var: Safe visual autoregressive model for text-to-image generative watermarking.arXiv preprint arXiv:2503.11324, 2025

    Ziyi Wang, Songbai Tan, Gang Xu, Xuerui Qiu, Hongbin Xu, Xin Meng, Ming Li, and Fei Richard Yu. Safe-var: Safe visual autoregressive model for text-to-image generative watermarking.arXiv preprint arXiv:2503.11324, 2025. 11

    2025 arXiv

  26. [35]

    Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust.arXiv preprint arXiv:2305.20030, 2023

    Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust.arXiv preprint arXiv:2305.20030, 2023

    2023 arXiv

  27. [36]

    Microsoft pledges to watermark ai-generated images and videos, 2023

    Kyle Wiggers. Microsoft pledges to watermark ai-generated images and videos, 2023

    2023

  28. [37]

    Wavelet transform based watermark for digital images.Optics Express, 3(12):497–511, 1998

    Xiang-Gen Xia, Charles G Boncelet, and Gonzalo R Arce. Wavelet transform based watermark for digital images.Optics Express, 3(12):497–511, 1998

    1998

  29. [38]

    Responsible disclosure of generative models using scalable fingerprinting.arXiv preprint arXiv:2012.08726, 2020

    Ning Yu, Vladislav Skripniuk, Dingfan Chen, Larry Davis, and Mario Fritz. Responsible disclosure of generative models using scalable fingerprinting.arXiv preprint arXiv:2012.08726, 2020

    2012 arXiv

  30. [39]

    An image is worth 32 tokens for reconstruction and generation.Advances in Neural Information Processing Systems, 37:128940–128966, 2024

    Qihang Yu, Mark Weber, Xueqing Deng, Xiaohui Shen, Daniel Cremers, and Liang-Chieh Chen. An image is worth 32 tokens for reconstruction and generation.Advances in Neural Information Processing Systems, 37:128940–128966, 2024

    2024

  31. [40]

    Robust invisible video watermarking with attention.arXiv preprint arXiv:1909.01285, 2019

    Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention.arXiv preprint arXiv:1909.01285, 2019

    1909 arXiv

  32. [41]

    Opt: Open pre-trained transformer language models.arXiv preprint arXiv:2205.01068, 2022

    Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christopher Dewan, Mona Diab, Xian Li, Xi Victoria Lin, et al. Opt: Open pre-trained transformer language models.arXiv preprint arXiv:2205.01068, 2022

    2022 arXiv

  33. [42]

    Hidden: Hiding data with deep networks

    Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. InProceedings of the European conference on computer vision (ECCV), pages 657–672, 2018

    2018

  34. [43]

    a photo of category

    Hazem Zohny, John McMillan, and Mike King. Ethics of generative ai, 2023. 12 Appendix A Limitations and Social Impact A.1 Limitations The verification of IndexMark watermark relies on the index reconstruction capability of the VQ-V AE model. A more robust encoder can enhance t...

    2023

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.