Pith. sign in

REVIEW 4 major objections 5 minor 87 references

Beyond Invisibility: Learning Robust Visible Watermarks for Stronger Copyright Protection

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Visible watermarks placed in an image's hardest-to-reconstruct regions survive removal attacks that defeat invisible protections.

desk verdict HARVIM is a genuinely new formulation with real empirical gains, but the paper overstates universality: the same-prior remover shows much larger gains than a different-prior one, so the 'intrinsic region' claim is not established. read the letter →

arxiv 2506.02665 v1 pith:62ONMWQR submitted 2025-06-03 cs.LG

Tianci Liu , Tong Yang , Quan Zhang , Qi Lei This is my paper
classification cs.LG
keywords hard-to-removevisiblewatermarkcopyrightprotectioninverseproblemsimageinpaintingbi-leveloptimizationmeta-learninggenerativepriorsremoval
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that visible watermarks, not invisible perturbations, are the right tool for copyright protection in the AI era, provided the watermark is placed where it is genuinely hard to remove. It proposes HARVIM, a method that learns a watermark for each image by treating watermark removal as an inpainting problem and choosing a watermark that makes the best possible inpainting reconstruction as different as possible from the original. The key claim is that the watermarked regions HARVIM selects are hard-to-reconstruct in an intrinsic sense: any generative model trained on real images will struggle to fill them in, so the protection transfers across removal methods and even across model architectures and training sets. If true, this would give creators a protection that does not need to be retrained whenever AI models change, and that also deters direct scraping.

What carries the argument

The load-bearing machinery is a bi-level optimization in which the lower level solves the inpainting problem $\operatorname*{argmax}_x \log p_G(x\mid y(m);\lambda)$ for a watermarked observation $y(m)$, and the upper level picks the watermark $m$ that minimizes the similarity between that optimal reconstruction and the original image. Because the lower-level optimum is intractable, the paper replaces it with $K$ unrolled gradient descent steps from a warm-started solution, relying on a result that the prior log-likelihood is locally convex near the optimum for normalizing-flow priors. The differentiable mask is obtained by a sigmoid relaxation of the binary inpainting mask, and a regularization term $R(m)$ keeps the watermark small while a conditional VAE keeps it legible.

What would settle it

Run the same HARVIM-learned watermarks against an inpainting method that uses a generative prior trained on the same image distribution, but solves the lower-level problem to high accuracy, for example with many unrolled steps or an exact MAP solver; if that remover reconstructs the watermarked region nearly as well as it does under random watermarks, then the hardness is an artifact of the K=1 approximation rather than an intrinsic image property.

Watch

Extended reading notes

Core claim

HARVIM's central discovery is that the difficulty of removing a visible watermark is a property of the image region, not of the secret or the attack. By formulating removal as a maximum-a-posteriori inpainting problem with a generative prior, the paper learns a watermark mask that maximizes the gap between the optimal reconstruction and the ground truth. The learned watermarks concentrate on visually rich areas such as hair-background boundaries and leafy texture, where plausibility-based reconstruction fails. Because the hardness is an intrinsic property of the image, the resulting watermark degrades both flow-based inpainting (Flow-R) and a diffusion-based inpainter (RePaint) even when they know the exact watermark mask, and it defeats blind watermark removers that cannot even localize it.

Load-bearing premise

The method relies on the one-step unrolled gradient approximation (K=1) of the lower-level reconstruction being accurate enough that the upper-level watermark update is not misled, a premise the paper itself notes is fragile for small K.

Editorial extensions

If this is right

  • Protection transfers to unseen generative models without retraining, because the watermark targets image regions that are hard for any real-data prior to complete.
  • Blind watermark removers that rely on detecting typical watermark patterns are likely to fail, since the watermark's location and appearance are image-specific.
  • Visible watermarks remain readable under JPEG compression and Gaussian blur, giving a fallback for direct-misuse deterrence that invisible methods cannot provide.
  • The same inverse-problem formulation could be reused with different removal operators, such as cropping or super-resolution, to broaden the notion of hardness beyond inpainting.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the hard-to-reconstruct region really is intrinsic, watermark generation might be made model-agnostic by estimating hardness from the image's local information content alone, without training a generative prior.
  • A stress test the paper does not run is to fine-tune a removal model adversarially on HARVIM-watermarked images; the outcome would separate hardness guaranteed by image statistics from hardness that removal models can overcome with adaptation.
  • The formulation points toward a quantitative notion of 'protectability' for an image: the smallest visible cover that forces every plausible reconstruction below a set similarity threshold.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes HARVIM, a method for learning visible watermarks that are intended to be hard to remove by generative-model-based inpainting. The problem is formulated as a bi-level optimization: the lower level is a MAP reconstruction of the watermarked region using a pretrained generative prior, and the upper level adjusts the watermark to minimize similarity between that reconstruction and the original image. Because the exact lower-level solution is intractable, the method uses K-step unrolled gradient descent with a normalizing-flow prior, along with a differentiable sigmoid approximation of the inpainting mask. Experiments cover CelebA, ImageNet, and Cartoon images, with two logo-style and two initial-style watermarks, and evaluate removal by Flow-R, RePaint, SLBR, and DeNet. The paper claims that HARVIM targets an intrinsic hard-to-reconstruct region of the image, giving protection that is agnostic to the removal method and to the choice of generative prior.

Significance. The high-level idea is timely and useful: moving from invisible perturbation-based protection to visible, hard-to-remove watermarks is a sensible direction, and the bi-level formulation provides a clean way to think about the problem. The paper also makes a concrete algorithmic proposal with an unrolled-gradient solver, and it demonstrates positive results in the same-prior setting (Flow-R). However, the strongest claim, that the learned watermarks protect against arbitrary generative models because they exploit an image-intrinsic property, is not established by the presented experiments. The empirical gains are substantially larger when the remover shares the prior used in training than when it does not, and the blind-remover baselines fail to locate the watermarks at all. The K=1 unrolled approximation is acknowledged by the authors to be potentially misleading and is not validated. If the paper is revised to test transfer across multiple independent priors, to validate the K-step approximation, and to temper the universality claims, it could make a solid contribution; in its current form the evidence supports a weaker, gray-box claim.

major comments (4)
  1. [Section 3.2, Table 1, Remark 2.1] The central claim that HARVIM targets an intrinsic hard-to-reconstruct region of the image, so that protection transfers to any generative model trained on real images, is not supported by the reported numbers. In Table 1, the vPSNR improvement over random watermarks is much larger when the remover is Flow-R (which uses the same normalizing flow G used in the upper-level optimization) than when it is RePaint (a diffusion-based remover): for the DIG watermark, the improvements are 5.44 vs 1.89 on CelebA, 3.52 vs 1.05 on ImageNet, and 7.39 vs 1.74 on Cartoon. This pattern is exactly what one would expect if HARVIM is exploiting properties specific to G rather than an image-intrinsic property. The gray-box/black-box explanation in Section 3.2 concedes that the watermark depends on G, and the anecdotal lizard example in Figure 3 is not quantitative evidence. I recommend adding experiments with multiple held-out generative priors (e.g., different normalizing flows or diffusion models trained on different data) and reporting transfer, or substantially weakening the universality claim in the abstract, Remark 2.1, and Section 3.2.
  2. [Section 2.4, Algorithm 1, Table 2] The K=1 unrolled gradient approximation of the lower-level optimum is the load-bearing step of the method, and it is not validated. The authors write that a small K 'often results in highly inaccurate approximation' and that 'the upper-level optimization will be misled as well,' yet Table 2 fixes K=1 and no ablation over K is reported. The justification from Liu et al. [48], namely local convexity of the log-posterior around the warm-started solution, is not shown to hold for the watermarked images in this setting, and no comparison to a converged MAP solution x*(m) is given. Without such evidence, the learned watermark m may be optimized against the one-step unrolled surrogate rather than against the true optimal reconstruction, which would undermine the interpretation that HARVIM finds hard-to-reconstruct regions. Please provide a validation of the approximation, such as comparing K=1 with larger K or with the converged solution, or reporting the gradient alignment between the unrolled surrogate and the true objective.
  3. [Section 3.2, Table 3, Section 4] The blind-remover results do not support the claim that HARVIM defeats 'all these methods.' SLBR and DeNet fail to localize the learned watermarks at all, producing vPSNR values near zero for both random and HARVIM watermarks; they therefore test detection failure, not reconstruction difficulty. The statement in Section 4 that HARVIM 'learns stronger watermarks to defeat all these methods' thus overstates what the evidence shows. Similarly, the DreamBooth protection claim in Section 1 and Figure 1 is illustrative only; no experiment evaluates HARVIM watermarks against DreamBooth or any other non-inpainting misuse. The paper's claim of 'protection agnostic to misuse scenarios' goes beyond the experiments, which cover only two inpainting-based removers, one of which shares the training prior. Please either add such experiments or restrict the claims to the tested setting.
  4. [Section 2.3, Eq. (3)] Equation (3) writes m* = min_m s(x*(m), xT) + R(m), but m* is a minimizer, not a minimum value; the expression should be argmin_m. In addition, the problem statement describes Am as a binary diagonal matrix, while Eq. (4) defines a continuous sigmoid relaxation; the paper should clarify whether the reported watermarked observations and the test-time masks are generated with the soft sigmoid or with a thresholded binary mask, since a train/test mismatch here could affect the validity of the removal experiments.
minor comments (5)
  1. [Abstract and Introduction] There are several typos and grammatical issues, including 'a intractable bi-level optimization' in the abstract and 'We propose HARVIM' with inconsistent capitalization in Section 2; the manuscript would benefit from a careful proofread.
  2. [Appendix B, Table 4] The table header uses 'DENET' in some rows and 'DeNet' elsewhere; the notation should be consistent with the main text.
  3. [Figure 3] The figure uses 'Digit WM' and 'Initial WM' labels at the bottom, but it is not immediately clear which columns correspond to which watermark family; adding per-column labels or a clearer caption would improve readability.
  4. [Related Work, Section 4] The related-work section cites Watermark Vaccine [49], an adversarial attack designed to prevent watermark removal, but no quantitative comparison with that method is included; a comparison would help position HARVIM relative to the closest prior work.
  5. [References] Some reference formatting issues appear, such as the spacing in 'George V oyatzis'; these should be corrected during revision.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: HARVIM is a genuine bi-level optimization, and the Flow-R in-family evaluation is transparently acknowledged; RePaint provides independent transfer evidence.

full rationale

The derivation chain from Eq. (3) to the learned watermark is a real optimization: m is chosen to minimize s(x*(m), x_T), where x*(m) is the MAP inpainting under generative prior G, with the lower level approximated by K-step unrolled gradient descent. No fitted parameter is later renamed as a prediction. The closest concern is that the Flow-R rows of Table 1 use the same prior G that guided the watermark optimization, so those numbers partly reflect the training objective rather than an independent removal test. The paper explicitly acknowledges this shared-prior explanation ('we hypothesize that this superior performance can be attributed to the fact that HARVIM and Flow-R share the same generative prior G'), and it supplies an independent heterogeneous-prior result with RePaint plus blind-remover results. The self-citation to [48] supplies the local-convexity justification for the approximate solver; it is prior published work with stated assumptions, not the paper's target claim, so it is not load-bearing circularity. The stronger extrapolation that every real-image generative model will reflect the hard-to-reconstruct region is under-supported by a single heterogeneous prior and by blind removers that fail to locate the watermark, but that is an evidence-scope limitation rather than a derivation that reduces to its own inputs. No equation is defined in terms of the conclusion it is used to establish.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central claim rests on: (1) the inpainting surrogate model of watermark removal, (2) the local convexity assumption that makes K=1 unrolling valid, (3) the generalization of a CelebA-trained flow prior to other distributions, and (4) the asserted intrinsic nature of hard-to-reconstruct regions. No new physical entities are introduced.

free parameters (5)
  • coefficient of R(m) (L1 norm weight) = 0.001
    Tuned to keep watermark size stable; not tuned on removal performance, but still a hand-chosen hyperparameter.
  • sigmoid smoothing factors alpha and beta = alpha=0.15, beta=0.01
    Chosen to make sigmoid have a wide range over pixel values; not optimized for performance.
  • unrolled steps K = 1
    Meta-learning approximation requires small K; the paper uses K=1.
  • lambda (prior weight) = 1 (target)
    An annealing schedule from 0 to 1; the schedule dynamics from Liu et al. [48].
  • learning rate = 0.05
    Default for AdamW.
assumptions (4)
  • domain assumption Watermark removal is equivalent to image inpainting with the exact watermark mask known to the attacker.
    This is the surrogate used in Eq. (3) and in the construction of A_m; real-world attackers may crop, corrupt, or use different models.
  • ad hoc to paper The log-posterior log p_G(x|y; lambda) is locally convex around the optimal solution, so a few (K=1) gradient steps from a warm start suffice to track x*(m).
    The paper relies on this to justify the meta-learning approximation, but the local convexity result comes from prior work and is only conjectured to extend to varying m.
  • domain assumption A RealNVP normalizing flow pretrained on CelebA is a reliable universal prior for natural images, including out-of-distribution ImageNet and Cartoon images.
    Used to score reconstructions; its OOD generalization is only tested on 100 images per dataset.
  • ad hoc to paper Hard-to-reconstruct regions are an intrinsic property of the image, independent of the generative prior used.
    Underlies the universal protection claim; no proof is given and the evidence is anecdotal.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Beyond Invisibility: Learning Robust Visible Watermarks for Stronger Copyright Protection." pith.science (2026). https://pith.science/paper/62ONMWQR

@misc{pith2026250602665,
  author       = {Pith},
  title        = {Pith review of: Beyond Invisibility: Learning Robust Visible Watermarks for Stronger Copyright Protection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/62ONMWQR}},
  note         = {Machine review of arXiv:2506.02665}
}
read the original abstract

As AI advances, copyrighted content faces growing risk of unauthorized use, whether through model training or direct misuse. Building upon invisible adversarial perturbation, recent works developed copyright protections against specific AI techniques such as unauthorized personalization through DreamBooth that are misused. However, these methods offer only short-term security, as they require retraining whenever the underlying model architectures change. To establish long-term protection aiming at better robustness, we go beyond invisible perturbation, and propose a universal approach that embeds \textit{visible} watermarks that are \textit{hard-to-remove} into images. Grounded in a new probabilistic and inverse problem-based formulation, our framework maximizes the discrepancy between the \textit{optimal} reconstruction and the original content. We develop an effective and efficient approximation algorithm to circumvent a intractable bi-level optimization. Experimental results demonstrate superiority of our approach across diverse scenarios.

Figures

Figures reproduced from arXiv: 2506.02665 by the authors.

Figure 1
Figure 1. Visible Watermarking can provide strong protection: DreamBooth trained on watermarked (“+wm”) images learn [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Visible watermarks remain resilient to strong dis [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Watermark removal performance of worse-case Flow-R and RePaint, and blind-case SLBR and DeNet. “Obs”and “Inpaint” show watermarked and surrogate inpainting images respectively. the primary focus of watermarking in the AI era has shifted to attack-based protection and invisible watermarking on AI-generated contents, leaving robust visible watermarking unsolved. In this work, we proposed a new learning-based visible w… view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

87 extracted references · 52 canonical work pages

  1. [48]

    Opti- mization for amortized inverse problems

    Tianci Liu, Tong Yang, Quan Zhang, and Qi Lei. Opti- mization for amortized inverse problems. InInterna- tional Conference on Machine Learning, pages 22289– 22319. PMLR, 2023

    work page 2023

  2. [1]

    Benchmarking the robustness of image water- marks.arXiv preprint arXiv:2401.08573, 2024

    Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, et al. Benchmarking the robustness of image water- marks.arXiv preprint arXiv:2401.08573, 2024

    arXiv 2024

  3. [2]

    Invertible generative models for inverse problems: mitigating representation error and dataset bias

    Muhammad Asim, Max Daniels, Oscar Leong, Ali Ahmed, and Paul Hand. Invertible generative models for inverse problems: mitigating representation error and dataset bias. InInternational Conference on Ma- chine Learning, pages 399–409. PMLR, 2020

    2020

  4. [3]

    Synthesizing robust adversarial exam- ples

    Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial exam- ples. InInternational conference on machine learning, pages 284–293. PMLR, 2018

    2018

  5. [4]

    The Effects of JPEG and JPEG2000 Compression on Attacks using Adversarial Examples

    Ayse Elvan Aydemir, Alptekin Temizel, and Tugba Taskaya Temizel. The effects of jpeg and jpeg2000 compression on attacks using adversarial examples.arXiv preprint arXiv:1803.10418, 2018

    work page Pith review arXiv 2018

  6. [5]

    Compressed Sensing Using Generative Mod- els

    Ashish Bora, Ajil Jalal, Eric Price, and Alexandros G Dimakis. Compressed Sensing Using Generative Mod- els. InInternational Conference on Machine Learning, pages 537–546. PMLR, 2017

    2017

  7. [6]

    An introduction to vision-language modeling.arXiv preprint arXiv:2405.17247, 2024

    Florian Bordes, Richard Yuanzhe Pang, Anurag Ajay, Alexander C Li, Adrien Bardes, Suzanne Petryk, Os- car Mañas, Zhiqiu Lin, Anas Mahmoud, Bargav Ja- yaraman, et al. An introduction to vision-language modeling.arXiv preprint arXiv:2405.17247, 2024

    arXiv 2024

  8. [7]

    Braudaway, Karen A

    Gordon W. Braudaway, Karen A. Magerlein, and Fred- erick Cole Mintzer. Protecting publicly available im- ages with a visible image watermark. InSPIE Pro- ceedings, volume 2659, pages 126–133, 1996

    1996

Show all 87 references
  1. [8]

    Generative adversarial networks model for visible watermark removal.IET Image Processing, 13 (10):1783–1789, 2019

    Zhiyi Cao, Shaozhang Niu, Jiwei Zhang, and Xinyi Wang. Generative adversarial networks model for visible watermark removal.IET Image Processing, 13 (10):1783–1789, 2019

    2019

  2. [9]

    Large-scale visible watermark detection and removal with deep convo- lutional networks

    Danni Cheng, Xiang Li, Wei-Hong Li, Chan Lu, Fake Li, Hua Zhao, and Wei-Shi Zheng. Large-scale visible watermark detection and removal with deep convo- lutional networks. InPattern Recognition and Com- puter Vision: First Chinese Conference, PRCV 2018, Guangzhou, China, Novemb...

    2018

  3. [10]

    Custom-edit: Text-guided im- age editing with customized diffusion models.arXiv preprint arXiv:2305.15779, 2023

    Jooyoung Choi, Yunjey Choi, Yunji Kim, Junho Kim, and Sungroh Yoon. Custom-edit: Text-guided im- age editing with customized diffusion models.arXiv preprint arXiv:2305.15779, 2023

    2023 arXiv

  4. [11]

    How to backdoor diffusion models? InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4015–4024, 2023

    Sheng-Yen Chou, Pin-Yu Chen, and Tsung-Yi Ho. How to backdoor diffusion models? InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4015–4024, 2023

    2023

  5. [12]

    Emnist: Extending mnist to hand- written letters

    Gregory Cohen, Saeed Afshar, Jonathan Tapson, and Andre Van Schaik. Emnist: Extending mnist to hand- written letters. In2017 international joint conference on neural networks (IJCNN), pages 2921–2926. IEEE, 2017

    2017

  6. [13]

    Secure spread spectrum watermarking for multimedia.IEEE transactions on image process- ing, 6(12):1673–1687, 1997

    Ingemar J Cox, Joe Kilian, F Thomson Leighton, and Talal Shamoon. Secure spread spectrum watermarking for multimedia.IEEE transactions on image process- ing, 6(12):1673–1687, 1997

    1997

  7. [14]

    Split then refine: stacked attention-guided resunets for blind single im- age visible watermark removal

    Xiaodong Cun and Chi-Man Pun. Split then refine: stacked attention-guided resunets for blind single im- age visible watermark removal. InProceedings of the AAAI conference on artificial intelligence, volume 35, pages 1184–1192, 2021

    2021

  8. [15]

    On the effectiveness of visible watermarks

    Tali Dekel, Michael Rubinstein, Ce Liu, and William T Freeman. On the effectiveness of visible watermarks. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 2146–2154, 2017

    2017

  9. [16]

    Why do ad- versarial attacks transfer? explaining transferability of evasion and poisoning attacks

    Ambra Demontis, Marco Melis, Maura Pintor, Matthew Jagielski, Battista Biggio, Alina Oprea, Cristina Nita-Rotaru, and Fabio Roli. Why do ad- versarial attacks transfer? explaining transferability of evasion and poisoning attacks. In28th USENIX secu- rity symposium (USENIX secu...

    2019

  10. [17]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009

    2009

  11. [18]

    Diffusion models beat gans on image synthesis.Advances in neural information processing systems, 34:8780–8794, 2021

    Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis.Advances in neural information processing systems, 34:8780–8794, 2021

    2021

  12. [19]

    Density Estimation Using Real NVP.arXiv preprint arXiv:1605.08803, 2016

    Laurent Dinh, Jascha Sohl-Dickstein, and Samy Ben- gio. Density Estimation Using Real NVP.arXiv preprint arXiv:1605.08803, 2016

    2016 arXiv

  13. [20]

    A study of the effect of jpg com- pression on adversarial images.arXiv preprint arXiv:1608.00853, 2016

    Gintare Karolina Dziugaite, Zoubin Ghahramani, and Daniel M Roy. A study of the effect of jpg com- pression on adversarial images.arXiv preprint arXiv:1608.00853, 2016

    2016 arXiv

  14. [21]

    The stable signa- ture: Rooting watermarks in latent diffusion models

    Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signa- ture: Rooting watermarks in latent diffusion models. InProceedings of the IEEE/CVF International Confer- ence on Computer Vision, pages 22466–22477, 2023

    2023

  15. [22]

    Model-agnostic meta-learning for fast adaptation of deep networks

    Chelsea Finn, Pieter Abbeel, and Sergey Levine. Model-agnostic meta-learning for fast adaptation of deep networks. InInternational conference on ma- chine learning, pages 1126–1135. PMLR, 2017

    2017

  16. [23]

    Bilevel pro- gramming for hyperparameter optimization and meta- learning

    Luca Franceschi, Paolo Frasconi, Saverio Salzo, Ric- cardo Grazzi, and Massimiliano Pontil. Bilevel pro- gramming for hyperparameter optimization and meta- learning. InInternational conference on machine learning, pages 1568–1577, 2018

    2018

  17. [24]

    An image is worth one word: Personalizing text- to-image generation using textual inversion.arXiv preprint arXiv:2208.01618, 2022

    Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patashnik, Amit H Bermano, Gal Chechik, and Daniel Cohen- Or. An image is worth one word: Personalizing text- to-image generation using textual inversion.arXiv preprint arXiv:2208.01618, 2022

    2022 arXiv

  18. [25]

    Witches’ brew: Industrial scale data poisoning via gradient matching.arXiv preprint arXiv:2009.02276, 2020

    Jonas Geiping, Liam Fowl, W Ronny Huang, Wo- jciech Czaja, Gavin Taylor, Michael Moeller, and Tom Goldstein. Witches’ brew: Industrial scale data poisoning via gradient matching.arXiv preprint arXiv:2009.02276, 2020

    2009 arXiv

  19. [26]

    Approximation methods for bilevel programming.arXiv preprint arXiv:1802.02246, 2018

    Saeed Ghadimi and Mengdi Wang. Approximation methods for bilevel programming.arXiv preprint arXiv:1802.02246, 2018

    2018 arXiv

  20. [27]

    Aigc challenges and opportunities related to public safety: a case study of chatgpt.Journal of Safety Science and Resilience, 4(4):329–339, 2023

    Danhuai Guo, Huixuan Chen, Ruoling Wu, and Yan- gang Wang. Aigc challenges and opportunities related to public safety: a case study of chatgpt.Journal of Safety Science and Resilience, 4(4):329–339, 2023

    2023

  21. [28]

    Denoising diffusion probabilistic models.Advances in neural information processing systems, 33:6840–6851, 2020

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models.Advances in neural information processing systems, 33:6840–6851, 2020

    2020

  22. [29]

    Wavelet domain adap- tive visible watermarking.Electronics Letters, 37(20): 1, 2001

    Yongjian Hu and Sam Kwong. Wavelet domain adap- tive visible watermarking.Electronics Letters, 37(20): 1, 2001

    2001

  23. [30]

    Attacking vis- ible watermarking schemes.IEEE transactions on multimedia, 6(1):16–30, 2004

    Chun-Hsiang Huang and Ja-Ling Wu. Attacking vis- ible watermarking schemes.IEEE transactions on multimedia, 6(1):16–30, 2004

    2004

  24. [31]

    Metapoison: Practical general-purpose clean-label data poisoning.Advances in Neural Information Processing Systems, 33:12080– 12091, 2020

    W Ronny Huang, Jonas Geiping, Liam Fowl, Gavin Taylor, and Tom Goldstein. Metapoison: Practical general-purpose clean-label data poisoning.Advances in Neural Information Processing Systems, 33:12080– 12091, 2020

    2020

  25. [32]

    Adap- tive visible watermarking of images

    Mohan S Kankanhalli, KR Ramakrishnan, et al. Adap- tive visible watermarking of images. InProceedings IEEE International Conference on Multimedia Com- puting and Systems, volume 1, pages 568–573. IEEE, 1999

    1999

  26. [33]

    Deep learning-based text-in-image water- marking.arXiv preprint arXiv:2404.13134, 2024

    Bishwa Karki, Chun-Hua Tsai, Pei-Chi Huang, and Xin Zhong. Deep learning-based text-in-image water- marking.arXiv preprint arXiv:2404.13134, 2024

    2024 arXiv

  27. [34]

    Markpainting: Ad- versarial machine learning meets inpainting

    David Khachaturov, Ilia Shumailov, Yiren Zhao, Nico- las Papernot, and Ross Anderson. Markpainting: Ad- versarial machine learning meets inpainting. InIn- ternational Conference on Machine Learning, pages 5409–5419. PMLR, 2021

    2021

  28. [35]

    Diffusionclip: Text-guided diffusion models for robust image manipulation

    Gwanghyun Kim, Taesung Kwon, and Jong Chul Ye. Diffusionclip: Text-guided diffusion models for robust image manipulation. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2426–2435, 2022

    2022

  29. [36]

    Auto-Encoding Variational Bayes.arXiv preprint arXiv:1312.6114, 2013

    Diederik P Kingma and Max Welling. Auto-Encoding Variational Bayes.arXiv preprint arXiv:1312.6114, 2013

    2013 arXiv

  30. [37]

    A water- mark for large language models

    John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A water- mark for large language models. InInternational Con- ference on Machine Learning, pages 17061–17084. PMLR, 2023

    2023

  31. [38]

    Protecting text ip in the era of llms with robust and scalable watermarking

    Gregory Kang Ruey Lau, Xinyuan Niu, Hieu Dao, Jiangwei Chen, Chuan-Sheng Foo, and Bryan Kian Hsiang Low. Protecting text ip in the era of llms with robust and scalable watermarking. InICML Workshop on Generative AI+ Law, 2024

    2024

  32. [39]

    Gradient-based learning applied to document recognition.Proceedings of the IEEE, 86(11):2278– 2324, 1998

    Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition.Proceedings of the IEEE, 86(11):2278– 2324, 1998

    1998

  33. [40]

    Inverting Deep Generative models, One layer at a time.Advances in neural information processing systems, 32, 2019

    Qi Lei, Ajil Jalal, Inderjit S Dhillon, and Alexandros G Dimakis. Inverting Deep Generative models, One layer at a time.Advances in neural information processing systems, 32, 2019

    2019

  34. [41]

    Removing interference and recov- ering content imaginatively for visible watermark re- moval

    Yicheng Leng, Chaowei Fang, Gen Li, Yixiang Fang, and Guanbin Li. Removing interference and recov- ering content imaginatively for visible watermark re- moval. InProceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 2983–2990, 2024

    2024

  35. [42]

    To- wards photo-realistic visible watermark removal with conditional generative adversarial networks

    Xiang Li, Chan Lu, Danni Cheng, Wei-Hong Li, Mei Cao, Bo Liu, Jiechao Ma, and Wei-Shi Zheng. To- wards photo-realistic visible watermark removal with conditional generative adversarial networks. InImage and Graphics: 10th International Conference, ICIG 2019, Beijing, China, Au...

    2019

  36. [43]

    Mist: Towards improved adversarial examples for diffusion models

    Chumeng Liang and Xiaoyu Wu. Mist: Towards improved adversarial examples for diffusion models. arXiv preprint arXiv:2305.12683, 2023

    2023 arXiv

  37. [44]

    Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples.arXiv preprint arXiv:2302.04578, 2023

    Chumeng Liang, Xiaoyu Wu, Yang Hua, Jiaru Zhang, Yiming Xue, Tao Song, Zhengui Xue, Ruhui Ma, and Haibing Guan. Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples.arXiv preprint arXiv:2302.04578, 2023

    2023 arXiv

  38. [45]

    Visible watermark removal via self- calibrated localization and background refinement

    Jing Liang, Li Niu, Fengjun Guo, Teng Long, and Liqing Zhang. Visible watermark removal via self- calibrated localization and background refinement. In Proceedings of the 29th ACM international conference on multimedia, pages 4426–4434, 2021

    2021

  39. [46]

    A survey of text watermarking in the era of large language models.ACM Computing Surveys, 2024

    Aiwei Liu, Leyi Pan, Yijian Lu, Jingjing Li, Xuming Hu, Xi Zhang, Lijie Wen, Irwin King, Hui Xiong, and Philip Yu. A survey of text watermarking in the era of large language models.ACM Computing Surveys, 2024

    2024

  40. [47]

    An Empirical Com- parison of GANs and Normalizing Flows for Density Estimation.arXiv preprint arXiv:2006.10175, 2020

    Tianci Liu and Jeffrey Regier. An Empirical Com- parison of GANs and Normalizing Flows for Density Estimation.arXiv preprint arXiv:2006.10175, 2020

    2006 arXiv

  41. [49]

    Watermark vaccine: Adversarial attacks to prevent watermark removal

    Xinwei Liu, Jian Liu, Yang Bai, Jindong Gu, Tao Chen, Xiaojun Jia, and Xiaochun Cao. Watermark vaccine: Adversarial attacks to prevent watermark removal. In European Conference on Computer Vision, pages 1–17. Springer, 2022

    2022

  42. [50]

    Toward the unification of generative and discriminative visual foundation model: A survey.The Visual Computer, pages 1–42, 2024

    Xu Liu, Tong Zhou, Chong Wang, Yuping Wang, Yuanxin Wang, Qinjingwen Cao, Weizhi Du, Yonghuan Yang, Junjun He, Yu Qiao, et al. Toward the unification of generative and discriminative visual foundation model: A survey.The Visual Computer, pages 1–42, 2024

    2024

  43. [51]

    Wdnet: Watermark-decomposition network for visible water- mark removal

    Yang Liu, Zhen Zhu, and Xiang Bai. Wdnet: Watermark-decomposition network for visible water- mark removal. InProceedings of the IEEE/CVF winter conference on applications of computer vision, pages 3685–3693, 2021

    2021

  44. [52]

    Metacloak: Preventing unau- thorized subject-driven text-to-image diffusion-based synthesis via meta-learning

    Yixin Liu, Chenrui Fan, Yutong Dai, Xun Chen, Pan Zhou, and Lichao Sun. Metacloak: Preventing unau- thorized subject-driven text-to-image diffusion-based synthesis via meta-learning. InProceedings of the IEEE/CVF Conference on Computer Vision and Pat- tern Recognition, pages 2...

    2024

  45. [53]

    Deep learning face attributes in the wild

    Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of International Conference on Computer Vision (ICCV), December 2015

    2015

  46. [54]

    Decoupled weight decay regularization

    Ilya Loshchilov and Frank Hutter. Decoupled weight decay regularization. InInternational Conference on Learning Representations, 2019

    2019

  47. [55]

    Repaint: Inpainting using denoising diffusion probabilistic mod- els

    Andreas Lugmayr, Martin Danelljan, Andres Romero, Fisher Yu, Radu Timofte, and Luc Van Gool. Repaint: Inpainting using denoising diffusion probabilistic mod- els. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 11461– 11471, 2022

    2022

  48. [56]

    Blind deep-learning-based image watermarking robust against geometric trans- formations

    Hannes Mareen, Lucas Antchougov, Glenn Van Wal- lendael, and Peter Lambert. Blind deep-learning-based image watermarking robust against geometric trans- formations. In2024 IEEE International Conference on Consumer Electronics (ICCE), pages 1–2. IEEE, 2024

    2024

  49. [57]

    A dual watermarking technique for im- ages

    Saraju P Mohanty, KR Ramakrishnan, and Mohan Kankanhalli. A dual watermarking technique for im- ages. InProceedings of the seventh ACM international conference on Multimedia (Part 2), pages 49–51, 1999

    1999

  50. [58]

    Deep Learning Techniques for Inverse Problems in Imaging.IEEE Journal on Selected Areas in Information Theory, 1(1):39–56, 2020

    Gregory Ongie, Ajil Jalal, Christopher A Metzler, Richard G Baraniuk, Alexandros G Dimakis, and Re- becca Willett. Deep Learning Techniques for Inverse Problems in Imaging.IEEE Journal on Selected Areas in Information Theory, 1(1):39–56, 2020

    2020

  51. [59]

    From trojan horses to castle walls: Unveiling bilateral backdoor effects in diffusion models.arXiv preprint arXiv:2311.02373, 2023

    Zhuoshi Pan, Yuguang Yao, Gaowen Liu, Bingquan Shen, H Vicky Zhao, Ramana Rao Kompella, and Sijia Liu. From trojan horses to castle walls: Unveiling bilateral backdoor effects in diffusion models.arXiv preprint arXiv:2311.02373, 2023

    2023 arXiv

  52. [60]

    Normalizing Flows for Probabilistic Mod- eling and Inference.Journal of Machine Learning Research, 22(57):1–64, 2021

    George Papamakarios, Eric Nalisnick, Danilo Jimenez Rezende, Shakir Mohamed, and Balaji Lakshmi- narayanan. Normalizing Flows for Probabilistic Mod- eling and Inference.Journal of Machine Learning Research, 22(57):1–64, 2021

    2021

  53. [61]

    Practical black-box attacks against machine learning

    Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. InProceedings of the 2017 ACM on Asia conference on computer and communications security, pages 506– 519, 2017

    2017

  54. [62]

    Image- adaptive watermarking using visual models.IEEE Journal on selected areas in communications, 16(4): 525–539, 1998

    Christine I Podilchuk and Wenjun Zeng. Image- adaptive watermarking using visual models.IEEE Journal on selected areas in communications, 16(4): 525–539, 1998

    1998

  55. [63]

    Language models are unsupervised multitask learners.OpenAI blog, 1 (8):9, 2019

    Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language models are unsupervised multitask learners.OpenAI blog, 1 (8):9, 2019

    2019

  56. [64]

    The devil is in the gan: backdoor attacks and defenses in deep generative models

    Ambrish Rawat, Killian Levacher, and Mathieu Sinn. The devil is in the gan: backdoor attacks and defenses in deep generative models. InEuropean Symposium on Research in Computer Security, pages 776–783, 2022

    2022

  57. [65]

    High-resolution im- age synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution im- age synthesis with latent diffusion models. InProceed- ings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022

    2022

  58. [66]

    Dream- booth: Fine tuning text-to-image diffusion models for subject-driven generation

    Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dream- booth: Fine tuning text-to-image diffusion models for subject-driven generation. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2250...

    2023

  59. [67]

    Raising the cost of malicious ai-powered image editing.arXiv preprint arXiv:2302.06588, 2023

    Hadi Salman, Alaa Khaddaj, Guillaume Leclerc, An- drew Ilyas, and Aleksander Madry. Raising the cost of malicious ai-powered image editing.arXiv preprint arXiv:2302.06588, 2023

    2023 arXiv

  60. [68]

    Glaze: Protecting artists from style mimicry by {Text-to- Image} models

    Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y Zhao. Glaze: Protecting artists from style mimicry by {Text-to- Image} models. In32nd USENIX Security Symposium (USENIX Security 23), pages 2187–2204, 2023

    2023

  61. [69]

    Dragdiffusion: Harnessing diffusion models for interactive point-based image editing

    Yujun Shi, Chuhui Xue, Jun Hao Liew, Jiachun Pan, Hanshu Yan, Wenqing Zhang, Vincent YF Tan, and Song Bai. Dragdiffusion: Harnessing diffusion models for interactive point-based image editing. InProceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognitio...

    2024

  62. [70]

    A review on bilevel optimization: From classical to evo- lutionary approaches and applications.IEEE trans- actions on evolutionary computation, 22(2):276–295, 2017

    Ankur Sinha, Pekka Malo, and Kalyanmoy Deb. A review on bilevel optimization: From classical to evo- lutionary approaches and applications.IEEE trans- actions on evolutionary computation, 22(2):276–295, 2017

    2017

  63. [71]

    Deep unsupervised learning using nonequilibrium thermodynamics

    Jascha Sohl-Dickstein, Eric Weiss, Niru Mah- eswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. In International conference on machine learning, pages 2256–2265. PMLR, 2015

    2015

  64. [72]

    Learn- ing structured output representation using deep condi- tional generative models.Advances in neural informa- tion processing systems, 28, 2015

    Kihyuk Sohn, Honglak Lee, and Xinchen Yan. Learn- ing structured output representation using deep condi- tional generative models.Advances in neural informa- tion processing systems, 28, 2015

    2015

  65. [73]

    Denet: dis- entangled embedding network for visible watermark removal

    Ruizhou Sun, Yukun Su, and Qingyao Wu. Denet: dis- entangled embedding network for visible watermark removal. InProceedings of the AAAI Conference on Artificial Intelligence, volume 37, pages 2411–2419, 2023

    2023

  66. [74]

    Anti- dreambooth: Protecting users from personalized text- to-image synthesis

    Thanh Van Le, Hao Phung, Thuan Hoang Nguyen, Quan Dao, Ngoc N Tran, and Anh Tran. Anti- dreambooth: Protecting users from personalized text- to-image synthesis. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 2116–2127, 2023

    2023

  67. [75]

    Diffusers: State-of-the-art diffusion mod- els

    Patrick von Platen, Suraj Patil, Anton Lozhkov, Pedro Cuenca, Nathan Lambert, Kashif Rasul, Mishig Davaadorj, Dhruv Nair, Sayak Paul, William Berman, Yiyi Xu, Steven Liu, and Thomas Wolf. Diffusers: State-of-the-art diffusion mod- els. https://github.com/huggingface/ diffusers, 2022

    2022

  68. [76]

    The use of water- marks in the protection of digital multimedia products

    George V oyatzis and Ioannis Pitas. The use of water- marks in the protection of digital multimedia products. Proceedings of the IEEE, 87(7):1197–1207, 1999

    1999

  69. [77]

    Chain-of-thought prompting elicits reasoning in large language models.Advances in neural information processing systems, 35:24824–24837, 2022

    Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. Chain-of-thought prompting elicits reasoning in large language models.Advances in neural information processing systems, 35:24824–24837, 2022

    2022

  70. [78]

    The emergence of deepfake technol- ogy: A review.Technology innovation management review, 9(11), 2019

    Mika Westerlund. The emergence of deepfake technol- ogy: A review.Technology innovation management review, 9(11), 2019

    2019

  71. [79]

    Solving In- verse Problems with a Flow-based Noise Model

    Jay Whang, Qi Lei, and Alex Dimakis. Solving In- verse Problems with a Flow-based Noise Model. In Proceedings of the 38th International Conference on Machine Learning, pages 11146–11157, 2021

    2021

  72. [80]

    Rethinking adver- sarial attacks as protection against diffusion-based mimicry

    Haotian Xue and Yongxin Chen. Rethinking adver- sarial attacks as protection against diffusion-based mimicry. InNeurips Safe Generative AI Workshop 2024, 2024

    2024

  73. [81]

    Diffusion models: A compre- hensive survey of methods and applications.ACM Computing Surveys, 56(4):1–39, 2023

    Ling Yang, Zhilong Zhang, Yang Song, Shenda Hong, Runsheng Xu, Yue Zhao, Wentao Zhang, Bin Cui, and Ming-Hsuan Yang. Diffusion models: A compre- hensive survey of methods and applications.ACM Computing Surveys, 56(4):1–39, 2023

    2023

  74. [82]

    Responsible disclosure of generative models using scalable fingerprinting.arXiv preprint arXiv:2012.08726, 2020

    Ning Yu, Vladislav Skripniuk, Dingfan Chen, Larry Davis, and Mario Fritz. Responsible disclosure of generative models using scalable fingerprinting.arXiv preprint arXiv:2012.08726, 2020

    2012 arXiv

  75. [83]

    The unreasonable ef- fectiveness of deep features as a perceptual metric

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable ef- fectiveness of deep features as a perceptual metric. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 586–595, 2018

    2018

  76. [84]

    Blurring fools the network–adversarial attacks by feature peak sup- pression and gaussian blurring.arXiv preprint arXiv:2012.11442, 2020

    Chenchen Zhao and Hao Li. Blurring fools the network–adversarial attacks by feature peak sup- pression and gaussian blurring.arXiv preprint arXiv:2012.11442, 2020

    2012 arXiv

  77. [85]

    A recipe for watermarking diffusion models.arXiv preprint arXiv:2303.10137, 2023

    Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Ngai-Man Cheung, and Min Lin. A recipe for watermarking diffusion models.arXiv preprint arXiv:2303.10137, 2023

    2023 arXiv

  78. [86]

    Zhengyue Zhao, Jinhao Duan, Kaidi Xu, Chenan Wang, Rui Zhang, Zidong Du, Qi Guo, and Xing Hu. Can protective perturbation safeguard personal data from being exploited by stable diffusion? InProceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pa...

    2024

  79. [87]

    coefficient of watermark regularizer

    Zheng Zhu, Xiaofeng Wang, Wangbo Zhao, Chen Min, Nianchen Deng, Min Dou, Yuqi Wang, Botian Shi, Kai Wang, Chi Zhang, et al. Is sora a world simulator? a comprehensive survey on general world models and beyond.arXiv preprint arXiv:2405.03520, 2024. A IMPLEMENTA TION DETAILS In ...

    2024

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.