GaussMarker: Robust Dual-Domain Watermark for Diffusion Models

Cheng Hong; Kecen Li; Xinwen Hou; Zhicong Huang

REVIEW 2 major objections 4 minor 1 cited by

GaussMarker: Robust Dual-Domain Watermark for Diffusion Models

T0 review · 2 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read GaussMarker embeds watermarks in both the sign pattern and the Fourier domain of a diffusion model's initial Gaussian noise, and a learned restorer keeps detection above 99% true-positive rate at 1% false-positive rate under common image…

desk verdict Solid dual-domain watermarking with a genuinely useful learned restorer, but the false positive calibration for the fused detector is underspecified and should be fixed before the headline numbers are trusted. read the letter →

arxiv 2506.11444 v1 pith:GCG5QXJX submitted 2025-06-13 cs.CR cs.CV

Kecen Li , Zhicong Huang , Xinwen Hou , Cheng Hong This is my paper

classification cs.CRcs.CV

keywords diffusionmodelwatermarkingtuning-freewatermarkdual-domainGaussianNoiseRestorerDDIMinversionimagerobustnessStablezero-bit

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

GaussMarker claims to be the first tuning-free watermark for latent diffusion models that embeds the watermark in both the spatial and frequency domains of the initial Gaussian noise, rather than in one domain. Its central promise is robustness: it reports average true-positive rates above 0.99 at a 1% false-positive rate and bit accuracy above 0.99 across Stable Diffusion V1.4, V2.0, and V2.1 under eight image distortions, and it also outperforms the compared baselines under four advanced attacks. This matters because existing single-domain tuning-free watermarks fail under small edits; for example, the paper reports that Gaussian Shading's detection accuracy drops from 100% to 64% after a 3-degree rotation. The paper's remedy is two-part: a learnable Gaussian Noise Restorer trained on synthetically transformed noise maps undoes edits before detection, and the detection scores from the spatial and frequency domains are fused into one decision.

What carries the argument

The load-bearing object is the signal map of the initial latent Gaussian noise: the binary sign pattern $s\in\{0,1\}^{c\times w\times h}$ produced by up-sampling and shuffling the watermark bits with a secret key. Spatial injection encodes the message by setting the sign of each noise entry according to this map, and detection recovers the message by voting through the inverse shuffle and average down-sampling (Eq. (1), (2), (5), (6)). Around this, the paper adds a Fourier ring watermark with a circular mask (Eq. (3), (4), (8)) and a learned Gaussian Noise Restorer, a UNet trained with binary cross-entropy on synthetically transformed signal maps plus negative samples (Eq. (11)), whose job is to undo geometric edits before bit extraction. A two-layer MLP fuser (Eq. (13)) combines the spatial and frequency scores. The mechanism works only if DDIM inversion of an edited image yields approximately the same geometric transform of the original noise's signal map, so the restorer's learned invariance transfers from synthetic transforms to real edits.

What would settle it

Take images and prompts not used in the paper, rotate or crop them by the magnitudes used in GNR training, and compare the per-image distribution of signal-map MSE between clean and edited DDIM inversions with the training-time distribution; if the distributions separate, the restorer's invariance will not transfer and detection accuracy should fall.

Watch

Extended reading notes

Core claim

On the paper's own terms, GaussMarker's discovery is that watermarked Gaussian noise can carry a recoverable watermark in two complementary domains at once, and that a model-independent restorer can compensate for the main weakness of single-domain schemes. The injector first turns an l-bit message into a scrambled sign pattern that replaces the signs of the initial latent noise, then adds a ring-shaped zero-bit watermark in the Fourier domain. Detection estimates the original noise by DDIM inversion, recovers a sign map, and restores it with GNR before scoring; the spatial bit score and frequency ring score are fused by a small MLP. The reported result is that fusing the two independent scores plus GNR yields consistent near-perfect detection across three Stable Diffusion versions, outperforming both the best tuning-free baselines and the tuning-based Stable Signature on the tested distortions, while remaining visually close to unwatermarked generation.

Load-bearing premise

The method works only if extracting the initial Gaussian noise from an edited image yields a noise whose pattern of positive and negative entries is approximately the same geometric transform of the original pattern, so a restorer trained on synthetic transforms of noise maps also fixes real rotations and crops.

Editorial extensions

If this is right

Latent diffusion models can be watermarked without any fine-tuning: injection changes only the initial noise, so GaussMarker applies to any already-trained Stable Diffusion-style model.
Fast sampling stays viable: with only 10 generation and 10 inversion steps, TPR@1%FPR and bit accuracy still exceed 0.99 and 0.98 respectively (Table 10).
The scheme supports user attribution at scale: XORing a shared model watermark with per-user keys gives near-perfect identification even with $10^7$ users under most distortions (Fig. 3(b)).
The watermark capacity reaches $2^{12}$ bits, and bit accuracy remains near 100% below $2^7$ bits, so the method can carry practical payloads (Fig. 3(a)).
Regeneration by another diffusion model is the hardest attack; the paper reports that all methods degrade substantially, though GaussMarker remains the strongest (Table 3).

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial inference: because GNR is trained entirely on synthetic transforms of noise maps rather than on any diffusion model, it should transfer to other latent diffusion models and might also restore the signal maps of single-domain watermarks such as Gaussian Shading, an extension the paper does not test.
Editorial inference: the support for the key assumption that inversion approximately commutes with image transforms is an aggregate MSE comparison (Fig. 2); a per-image distributional test of restored signal maps under rotations and crops would reveal whether the reported robustness holds for images and prompts outside the evaluation set.
Editorial inference: the bit-voting spatial code plus the Fourier ring watermark suggests a natural next step of applying error-correcting codes to the extracted sign map, which could hold higher-capacity watermarks or extend robustness to the regeneration attack, neither of which the paper explores.
Editorial inference: dual-domain editing costs a little visual fidelity relative to the best single-domain method (about 0.6% lower CLIP score than Gaussian Shading), so combining the restorer with a less content-altering injection is a concrete direction for improvement that the paper itself flags.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: this is a solid, empirically thorough watermarking paper with a genuinely new component, but the headline FPR numbers rest on a threshold procedure that isn't described. That's a fixable gap, not a fatal one.

The new thing is the GNR. Dual-domain injection (spatial sign bits + frequency ring) is a reasonable combination, and the pipelined injector is well-motivated, but it's the learned restorer that actually solves the rotation/cropping fragility that plagues tuning-free methods. The ablations are clean: each component (spatial, frequency, GNR, fuser) adds measurable value, and the gains hold across SD 1.4/2.0/2.1. The training cost is modest and model-independent, which is a real practical point. Credit is due for that.

The soft spots are in the evaluation methodology. The biggest one: TPR@1%FPR for the fused MLP score. The paper reports this number but never says how the 1% threshold is set. Appendix C gives the analytic Bernoulli formula for multi-bit watermarks, but that doesn't apply to a continuous MLP output. If the threshold is chosen empirically on the same 1,000 unwatermarked images used for evaluation, the FPR is being controlled in-sample, and the TPR number is optimistic. This is the load-bearing issue for the 'state-of-the-art' claim, and I'd want the authors to state the procedure and ideally report a separate validation set.

The second issue is that GNR is trained on rotations up to 180° and cropping down to 70%—the same transformation families used in the evaluation. Table 6 shows that when the training range excludes 75°, bit accuracy collapses. So the rotation/cropping robustness is a trained property, not an emergent invariance. That's a limitation, but the paper is transparent about it, and the approach still works for those distortions. It just doesn't generalize far beyond the augmentation range.

The GNR train/deploy mismatch (trained on T(s_T), deployed on estimated signal maps from DDIM inversion) is real but secondary. Figure 2 supports the commuting assumption, and the empirical results back it up. I wouldn't hold that against the paper.

No code, no error bars, Fuser trained on 100 images—these are reproducibility weaknesses, but they don't undermine the logic of the method. The paper deserves a serious referee; the main ask would be to clarify the FPR threshold procedure and release code. This is a conditional accept toward revision, not a reject.

Referee Report

2 major / 4 minor

Summary. GaussMarker proposes a tuning-free dual-domain watermark for latent diffusion models. It embeds a multi-bit watermark in the spatial domain by fixing the signs of the initial Gaussian noise and a zero-bit ring-shaped watermark in the frequency domain, then detects via DDIM inversion, a learned Gaussian Noise Restorer (GNR) that is intended to make the extracted signal maps invariant to rotation and cropping, and a two-layer MLP fuser that combines the spatial and frequency detection scores. The paper reports experiments on Stable Diffusion V1.4/V2.0/V2.1 under eight image distortions and four advanced attacks, claiming that GaussMarker achieves average TPR@1%FPR above 0.99 and bit accuracy above 0.99 under most conditions, outperforming existing tuning-free methods and the tuning-based Stable Signature while preserving image quality.

Significance. If the results hold, this is a strong practical contribution: it is tuning-free, the GNR is model-independent and trains in about 72 minutes, and the ablations (Tables 4, 6, 8) clearly attribute the gains to the dual-domain injection, GNR, and score fusion. The paper also addresses an important weakness of prior tuning-free watermarks (e.g., Gaussian Shading) under rotation and cropping. However, the central quantitative claim of "better recall and lower false positive rates" depends on an unspecified false-positive calibration for the fused MLP score, which makes the headline TPR@1%FPR numbers non-reproducible as written. The GNR generalization assumption is also supported only by aggregate MSE evidence rather than a distributional validation. These are load-bearing gaps that should be fixed before the results can be fully trusted.

major comments (2)

[3.2.3 / Appendix C / 4.1] The paper reports TPR@1%FPR for the final fused score r = Fuser(rs, rf), which is the output of a two-layer MLP, but it never states how the 1% FPR threshold is determined for this continuous score. Appendix C's Eq. (16) gives an analytic FPR formula for multi-bit watermark extraction under the Bernoulli(0.5) bit assumption; that formula does not describe the null distribution of the MLP's output. If the threshold is chosen empirically from the same 1,000 un-watermarked images used in the evaluation (Sec. 4.1), the reported TPR@1%FPR is an in-sample quantity, and with roughly ten expected false positives at 1% FPR the threshold estimate is noisy and the FPR is not independently demonstrated. The central claim of "better recall and lower false positive rates" relative to baselines is therefore not reproducible from the text. Please specify the exact threshold-selection protocol (e.g., a separate validation set, the number of negatives used, and whether Eq. (16) is used at all), and report TPR@1%FPR with a held-out negative set or confidence bounds.
[3.2.2, Eq. (10), Fig. 2] The GNR is trained on synthetically transformed signal maps T(s_T) but deployed on signal maps estimated by DDIM inversion from actually edited images. The paper's justification is the assumption Inversion(T(x)) ≈ T(z_T), stated after Eq. (10), and Fig. 2 reports aggregate MSE values showing that inverse-editing reduces error. However, aggregate MSE does not establish that the distribution of inversion outputs matches the training distribution of T(s_T); a mismatch could make the reported rotation/cropping robustness specific to the test set rather than general. Please provide a distributional comparison (e.g., per-angle or per-crop-ratio histograms of the restored signal map errors) or a held-out evaluation on transformations not seen in GNR training, to support the generalization claim.

minor comments (4)

[Appendix B.1] "leaning rate" should be "learning rate" in the Stable Signature baseline description.
[Section 4.4] The sentence "Tab. 8 presents Tab. 4 under various image distortions" is ambiguous; rephrase as "Table 8 reports the results of the ablation in Table 4 under each image distortion."
[Table 1] The row/column formatting of Table 1 is difficult to parse because method names and SD versions are interleaved with numbers; consider splitting into separate tables per SD version or using clearer horizontal rules.
[Eq. (11)] Define s_T explicitly as the signal map of unwatermarked Gaussian noise before the objective is given, and clarify in the last two terms whether the GNR input/target uses s_T or s^{s,f}_T; currently the notation is easy to misread.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: GaussMarker's components are trained with objectives that do not assume the final detection result, and its empirical claims are not forced by construction or by a self-citation chain.

full rationale

This is an empirical systems paper, not a formal derivation, and I found no step in which a reported prediction or claimed result is equivalent by construction to a fitted input. The spatial-domain score rs = -||omega_tilde - omega||^2 (Eq. 6) and the frequency-domain score rf = -||(F(z_tilde_T) - omega_f) * M||^2 (Eq. 8) are standard correlation detectors: the watermark omega is a fixed random input, and the detection procedure tests whether the inverted noise carries that same fixed signal. There is no definitional loop in which the detector is defined in terms of the detection target. The GNR training objective (Eqs. 10-11) is a supervised invariance/denoising loss: it maps transformed signal maps T(s^{s,f}_T) back to s^{s,f}_T for watermarked inputs, and to the input for unwatermarked inputs, with a negative-sample term. This objective does not incorporate the test-time detector score or the evaluation metric as a training label. Deployment of the GNR on DDIM-inverted edited images uses the approximation Inversion(T(x)) approximately equal to T(z_T) (Sec. 3.2.2, after Eq. 10), which is an empirical assumption supported by the MSE comparison in Figure 2; even if that assumption fails under some edits, that would be a generalization gap, not circularity. The Fuser (Eq. 13) is a two-layer MLP trained as a supervised binary classifier on 100 watermarked and 100 unwatermarked images (Sec. 3.2.3), with evaluation on a separate set of 1,000 watermarked and 1,000 unwatermarked images (Sec. 4.1); thus the TPR@1%FPR numbers are not obtained by fitting a threshold or classifier on the evaluation set. The paper relies on prior work (Tree-Ring, Gaussian Shading, PRC, ensemble theory) for standard building blocks, but there is no load-bearing self-citation chain: the cited works are not by the present authors, and the paper's novelty claims are not justified by an appeal to the authors' own unverified theorems. One genuine caveat is that Appendix C's FPR formula (Eq. 16) is derived for bit-wise Bernoulli score distributions and the paper does not state how the 1%-FPR threshold is selected for the fused continuous score r = Fuser(rs, rf); this makes the headline TPR@1%FPR numbers difficult to reproduce exactly, but the text provides no construction showing that the threshold reduces to the fitted parameters, so this is an omitted procedural detail rather than a demonstrated circular step.

Assumptions & free parameters 5 free parameters · 4 assumptions · 1 invented entities

The method relies on a handful of domain assumptions about DDIM inversion, the transferability of GNR training, and the analytic FPR model. The main free parameters are the frequency mask radius, the GNR training transformation set, and the GNR/Fuser hyperparameters. The GNR is the only genuinely new component, and it is not validated on an external benchmark.

free parameters (5)

Mask radius rf = 4
Controls the radius of the frequency-domain ring watermark. Explore in Appendix D.5; performance drops for rf=0 and for large radii.
GNR training transformation distribution T = rotation [-180,180], cropping [70%,100%], sign flip p=0.35
The reported robustness under rotation and cropping is achieved by training the GNR on these specific transformation families, as shown in Table 6 where omitting rotation training drops bit accuracy to 0.512.
GNR architecture and training hyperparameters = 30M UNet, lr=0.0001, batch=32, steps=50000
Chosen via experiments in Appendix D.3; larger GNR improves TPR, smaller GNR improves bit accuracy.
Fuser training set size = 100 watermarked + 100 unwatermarked images
The MLP score fusion module is trained on a very small calibration set, which may affect the precision of TPR@1%FPR estimates.
Watermark length l = 256 bits
A design choice for the multi-bit spatial watermark; effects of capacity up to 2^12 bits are explored in Figure 3(a).

assumptions (4)

domain assumption DDIM inversion with an empty prompt and guidance scale 0 produces a Gaussian noise estimate whose sign pattern carries the spatial watermark.
Stated in Section 3.2 and used throughout; the inversion quality determines whether the injected sign information survives.
domain assumption Inversion approximately commutes with geometric transformations in signal space, i.e., Inversion(T(x)) approximates T(z_T).
The cornerstone of GNR training in Section 3.2.2, Eq. (10); the authors provide empirical support in Figure 2 but the assumption is not proven.
domain assumption For unwatermarked images, each extracted bit of the spatial watermark is an independent Bernoulli(0.5) variable.
Used in Appendix C to compute analytic false positive rates following Yu et al. (2021); independence is not explicitly verified.
domain assumption The ring-shaped Fourier pattern in the masked frequency band is preserved under common image distortions.
The frequency-domain watermark design in Appendix B.2 relies on Fourier invariances inherited from Tree-Ring; the paper inherits this property rather than proving it for the dual-domain pipeline.

invented entities (1)

Gaussian Noise Restorer (GNR)
purpose: A learnable UNet that restores the signal map of the initial noise after geometric transformations, improving spatial-domain watermark detection under rotation and cropping.
Introduced in this paper; its effectiveness is validated only on the authors' own evaluation suite and no independent benchmark or external dataset is used to validate transfer.

how reviews work

0 comments

Cite this review

Pith. "Pith review of GaussMarker: Robust Dual-Domain Watermark for Diffusion Models." pith.science (2026). https://pith.science/paper/GCG5QXJX

@misc{pith2026250611444,
  author       = {Pith},
  title        = {Pith review of: GaussMarker: Robust Dual-Domain Watermark for Diffusion Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GCG5QXJX}},
  note         = {Machine review of arXiv:2506.11444}
}

read the original abstract

As Diffusion Models (DM) generate increasingly realistic images, related issues such as copyright and misuse have become a growing concern. Watermarking is one of the promising solutions. Existing methods inject the watermark into the single-domain of initial Gaussian noise for generation, which suffers from unsatisfactory robustness. This paper presents the first dual-domain DM watermarking approach using a pipelined injector to consistently embed watermarks in both the spatial and frequency domains. To further boost robustness against certain image manipulations and advanced attacks, we introduce a model-independent learnable Gaussian Noise Restorer (GNR) to refine Gaussian noise extracted from manipulated images and enhance detection robustness by integrating the detection scores of both watermarks. GaussMarker efficiently achieves state-of-the-art performance under eight image distortions and four advanced attacks across three versions of Stable Diffusion with better recall and lower false positive rates, as preferred in real applications.

Figures

Figures reproduced from arXiv: 2506.11444 by the authors.

**Figure 1.** Overview of GaussMarker. The l-bits watermark ω is up-sampled and shuffled into a signal map s for l-bits spatial-domain watermark. s is used to sample a Fourier map ω f for zero-bit frequency-domain watermark. Both s and ω f are fixed during the injection and detection. (1) Watermark Injection. We inject a multi-bit watermark and a zero-bit watermark into the spatial domain and frequency domain of Gaussian noise ma… view at source ↗

**Figure 2.** The Mean Square Error between the signal maps estimated from the clean image and image which is edited with rotation (sr) or cropping (sc). sor and soc are obtained through performing an inverse edition on sr and sc respectively. For example, if sr is estimated from an image that has been rotated by 12◦ , we rotate sr by −12◦ to obtain sor. GNR G, the objective of GNR can be formalized as Minimize GNR∈G [PITH_FULL… view at source ↗

**Figure 4.** As shown in Tab. 1, GaussMarker exhibits strong [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗

Figures from the paper (6 more)

**Figure 3.** Figure 3: (a) Bit accuracy of GaussMarker when injecting watermark of different bits. (2) Identification accuracy of GaussMarker when allocating watermarks to different numbers of users. of GaussMarker when the watermark has different numbers of bits. Since GaussMarker needs th…

**Figure 4.** Figure 4: Examples of attacks used in our experiments. (c) JPEG. Compress the image using JPEG and set the quality factor to 25. (d) C&S. Randomly crop 75% area of the image and scale it into the original resolution. (e) R. Drop. Randomly mask 80% area of the image with black pi…

**Figure 5.** Figure 5: Detection performance of GaussMarker under eight image distortions of different intensities. D. More results D.1. Robustness To further test the robustness, we conduct experiments using different intensities of noises for image distortions. Except for Gaussian Noise, T…

**Figure 6.** Figure 6: TPR1%FPR and bit accuracy of GaussMarker with different sizes of GNR across three versions of SD. D.3. Model Size of GNR We test five different sizes of GNR (0.5M, 1.9M, 7.7M, 17.3M, and 30.8M), implementing each through setting the base feature dimension of the UNet …

**Figure 7.** Figure 7: Visualization of the masks with different rf for frequency-domain watermarks. 0 2 4 6 8 10 Radius of Mask 0.88 0.90 0.92 0.94 0.96 0.98 1.00 TPR@1%FPR SD V2.1 SD V2.0 SD V1.4 0 2 4 6 8 10 Radius of Mask 0.986 0.988 0.990 0.992 Bit accuracy SD V2.1 SD V2.0 SD V1.4 [PIT…

**Figure 8.** Figure 8: TPR1%FPR and bit accuracy of GaussMarker when using masks with different radius rf for frequency-domain watermark. rf = 0 means GaussMarker does not inject the frequencydomain watermark [PITH_FULL_IMAGE:figures/full_fig_p014_8.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

FARI: Robust One-Step Inversion for Watermarking in Diffusion Models
cs.CR 2026-07 accept novelty 6.0 of 10

One-step adversarially LoRA-tuned inversion exploits low-curvature reverse trajectories to beat 50-step DDIM on watermark robustness after ~20 minutes of fine-tuning.

Reference graph

Works this paper leans on

12 extracted references · 9 canonical work pages · cited by 1 Pith paper

[2]

com/CA/text/AB3211/id/2984195

URL https://legiscan. com/CA/text/AB3211/id/2984195. Accessed: 2024-09-24. Carlini, N., Hayes, J., Nasr, M., Jagielski, M., Sehwag, V ., Tram`er, F., Balle, B., Ippolito, D., and Wallace, E. Extracting training data from diffusion models. In 32nd USENIX Security Symposium, USENIX ,

work page arXiv 2024
[4]

Accessed: 2024-09-24

URL https: //eur-lex.europa.eu/legal-content/ EN/TXT/?uri=CELEX:32024R1689. Accessed: 2024-09-24. 9 GaussMarker: Robust Dual-Domain Watermarks for Diffusion Models Feng, W., Zhou, W., He, J., Zhang, J., Wei, T., Li, G., Zhang, T., Zhang, W., and Yu, N. Aqualora: Toward white-box protection for customized stable diffusion models via watermark lora. In ICML,

work page 2024
[5]

and Hengartner, U

Kassis, A. and Hengartner, U. Unmarker: A universal at- tack on defensive watermarking. CoRR, abs/2405.08363,

arXiv
[6]

Advanced Attacks Compression Attack

B.4. Advanced Attacks Compression Attack. Following previous works (Yang et al., 2024), we utilize two pre-trained V AE compressors, termed as V AE-1 (Cheng et al.,

work page 2024
[8]

Compared to Stable Signature, LaWa is more robust to image modifications and can handle mul- tiple users for one image generation service

proposes to add some intermediate layers into the decoder, and only fine-tune these new layers with other modules frozen. Compared to Stable Signature, LaWa is more robust to image modifications and can handle mul- tiple users for one image generation service. In order to defend against white-box attacks, AquaLoRA proposes to fine-tune the UNet, which con...

work page 2024
[9]

Results of different Fusers across three SD V1.4 / V2.0 / V 2.1. Fuser Type TPR1%FPR ROC-AUC KNN-5 0.997 / 0.994 / 0.993 0.998 / 0.997 / 0.996 Linear SVM 0.998 / 0.991 / 0.995 0.999 / 0.999 / 0.999 RBF SVM 0.998 / 0.992 / 0.996 0.999 / 0.999 / 0.999 Random Forest0.998 / 0.993 / 0.994 0.999 / 0.999 / 0.999 Decision Tree 0.661 / 0.647 / 0.875 0.988 / 0.982 ...

work page 2023
[11]

Specifically, the watermarked image will undergo multiple cycles of noising and be denoised through this pre-trained diffusion model for regeneration

pre-trained on ImageNet to perform regen- eration attack. Specifically, the watermarked image will undergo multiple cycles of noising and be denoised through this pre-trained diffusion model for regeneration. Visually-Aware Attack. Recently, Kassis et al. proposed the first practical universal attack, UnMarker (Kassis & Hen- gartner, 2024), on defensive w...

work page 2024
[2014]

Water- marking diffusion model

Liu, Y ., Li, Z., Backes, M., Shen, Y ., and Zhang, Y . Water- marking diffusion model. CoRR, abs/2305.12502,

arXiv

Show all 12 references

[2018]

Regeneration Attack

respectively, for image compression. Regeneration Attack. Following a recent benchmark (An et al., 2024), we utilize a diffusion model (Dhariwal & Nichol,

2024
[2021]

Artificial Intelligence Act: Regu- lation (EU) 2024/1689 of the European Parliament and of the Council, June

European Union. Artificial Intelligence Act: Regu- lation (EU) 2024/1689 of the European Parliament and of the Council, June

2024
[2023]

They construct a dataset containing the pair of watermarked prompts and the watermarked images, as well as the clean prompts and the clean images for fine-tuning LDM

proposes the first tuning-based method. They construct a dataset containing the pair of watermarked prompts and the watermarked images, as well as the clean prompts and the clean images for fine-tuning LDM. How- ever, they do not provide a clear method to detect whether the wa...

2023
[2024]

J., and Johnston, N

Ball´e, J., Minnen, D., Singh, S., Hwang, S. J., and Johnston, N. Variational image compression with a scale hyperprior. arXiv preprint arXiv:1802.01436,

arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [2]

com/CA/text/AB3211/id/2984195

URL https://legiscan. com/CA/text/AB3211/id/2984195. Accessed: 2024-09-24. Carlini, N., Hayes, J., Nasr, M., Jagielski, M., Sehwag, V ., Tram`er, F., Balle, B., Ippolito, D., and Wallace, E. Extracting training data from diffusion models. In 32nd USENIX Security Symposium, USENIX ,

work page arXiv 2024

[2] [4]

Accessed: 2024-09-24

URL https: //eur-lex.europa.eu/legal-content/ EN/TXT/?uri=CELEX:32024R1689. Accessed: 2024-09-24. 9 GaussMarker: Robust Dual-Domain Watermarks for Diffusion Models Feng, W., Zhou, W., He, J., Zhang, J., Wei, T., Li, G., Zhang, T., Zhang, W., and Yu, N. Aqualora: Toward white-box protection for customized stable diffusion models via watermark lora. In ICML,

work page 2024

[3] [5]

and Hengartner, U

Kassis, A. and Hengartner, U. Unmarker: A universal at- tack on defensive watermarking. CoRR, abs/2405.08363,

arXiv

[4] [6]

Advanced Attacks Compression Attack

B.4. Advanced Attacks Compression Attack. Following previous works (Yang et al., 2024), we utilize two pre-trained V AE compressors, termed as V AE-1 (Cheng et al.,

work page 2024

[5] [8]

Compared to Stable Signature, LaWa is more robust to image modifications and can handle mul- tiple users for one image generation service

proposes to add some intermediate layers into the decoder, and only fine-tune these new layers with other modules frozen. Compared to Stable Signature, LaWa is more robust to image modifications and can handle mul- tiple users for one image generation service. In order to defend against white-box attacks, AquaLoRA proposes to fine-tune the UNet, which con...

work page 2024

[6] [9]

Results of different Fusers across three SD V1.4 / V2.0 / V 2.1. Fuser Type TPR1%FPR ROC-AUC KNN-5 0.997 / 0.994 / 0.993 0.998 / 0.997 / 0.996 Linear SVM 0.998 / 0.991 / 0.995 0.999 / 0.999 / 0.999 RBF SVM 0.998 / 0.992 / 0.996 0.999 / 0.999 / 0.999 Random Forest0.998 / 0.993 / 0.994 0.999 / 0.999 / 0.999 Decision Tree 0.661 / 0.647 / 0.875 0.988 / 0.982 ...

work page 2023

[7] [11]

Specifically, the watermarked image will undergo multiple cycles of noising and be denoised through this pre-trained diffusion model for regeneration

pre-trained on ImageNet to perform regen- eration attack. Specifically, the watermarked image will undergo multiple cycles of noising and be denoised through this pre-trained diffusion model for regeneration. Visually-Aware Attack. Recently, Kassis et al. proposed the first practical universal attack, UnMarker (Kassis & Hen- gartner, 2024), on defensive w...

work page 2024

[8] [2014]

Water- marking diffusion model

Liu, Y ., Li, Z., Backes, M., Shen, Y ., and Zhang, Y . Water- marking diffusion model. CoRR, abs/2305.12502,

arXiv