Pith. sign in

REVIEW 5 major objections 5 minor 57 references

Autoregressive Images Watermarking through Lexical Biasing: An Approach Resistant to Regeneration Attack

T0 review · 5 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Lexical Bias Watermarking embeds watermarks into the discrete token maps of autoregressive image generators by biasing token selection toward a secret green list, and the paper claims this signal survives regeneration attacks that erase…

desk verdict Novel lexical-biasing watermark for AR image models with a genuine contribution, but the headline regeneration-robustness numbers are internally inconsistent across tables and need a correction before the SOTA claim is credible. read the letter →

arxiv 2506.01011 v1 pith:4UTRJIAW submitted 2025-06-01 cs.CR

Siqi Hui , Yiren Song , Sanping Zhou , Ye Deng , Wenli Huang , Jinjun Wang This is my paper
classification cs.CR
keywords autoregressiveimagegenerationwatermarkinggreenlisttokenbiasingregenerationattackVQ-VAEmapz-scoredetectionpost-hocmulti-green-listsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Lexical Bias Watermarking (LBW) claims that autoregressive image generators can carry a watermark by slightly favoring a secret set of codebook tokens, the green list, during sequential token prediction, and that the watermark survives attacks, including diffusion-based regeneration, that erase watermarks embedded in diffusion latents. The paper argues that because re-encoding an AR-generated image recovers most of its original token map, the green-token surplus can be detected later with a simple z-score test that only needs the VQ-VAE quantizer, not the generative model. This matters because AR image models are becoming widespread, while existing in-generation watermarking methods are built for diffusion models and do not transfer directly. The authors report that LBW, in hard, soft, and post-hoc variants, keeps high detection rates under conventional image attacks and outperforms diffusion-oriented watermarks against regeneration attacks.

What carries the argument

The central object is the green/red partition of the VQ-VAE codebook together with a soft logit bias. Each codebook token is either green or red for a given watermark key; during autoregressive sampling the logits of green tokens are increased by a constant sigma, while the hard variant forbids red tokens entirely, which raises the expected green-token share from the base ratio gamma. Detection re-quantizes the image and computes the z-score comparing the observed green-token count with the expected binomial count; a z-score above a threshold declares the watermark present. The multi-green-list construction spreads the choice across 32 balanced lists so that no single token is consistently favored, and the whole argument rests on the VQ-VAE's token consistency, which the paper documents across VQ-GAN, VAR, and RAR.

What would settle it

Take a set of LBW-watermarked images from RAR, run CtrlRegen, re-encode the outputs, and count green tokens with the paper's pool of lists; if the average green-token z-score falls below the detection threshold on images that still resemble the original class, the claim that token maps survive regeneration is falsified. A cheaper version is to apply JPEG compression at quality 10 and check whether the green-token surplus, which the paper reports as surviving at quality 25, is actually preserved.

Watch

Extended reading notes

Core claim

The paper's central claim is that watermark information for AR image generation can live in the discrete token map itself rather than in continuous latent states. During generation, the model's logits are nudged by a constant bias toward tokens from a randomly selected green list, or, in the post-hoc variant, red tokens are replaced by their nearest green neighbors, and detection re-encodes the image and applies a one-proportion z-test on green tokens. Because token maps are largely preserved when a generated image is quantized again, the bias survives re-encoding; because the watermark is tied to discrete tokens rather than diffusion latents, regeneration attacks that perturb latents do not remove it. The paper further claims that using a pool of green lists, balanced so each token is green equally often across lists, makes the token-frequency distribution of watermarked images nearly indistinguishable from clean images, protecting against white-box list-estimation attacks.

Load-bearing premise

The scheme depends on the observation that re-encoding an AR-generated image recovers a large share of the original token map; if a regeneration attack breaks that token consistency, the green-token surplus disappears and the z-score test loses its signal.

Editorial extensions

If this is right

  • Diffusion-based regeneration attacks that erase watermarks by re-sampling latents will not automatically remove a token-map watermark, since the detector reads signal from re-quantized discrete tokens rather than from latent space.
  • The same watermarking procedure works both during generation and after the fact: any image can be quantized, its red tokens replaced by nearest green tokens, and reconstructed, so a single detector covers both in-generation and post-hoc watermarks.
  • Detection is lightweight: it requires only the VQ-VAE encoder and the green-list pool, not the transformer-based generator, so provenance checks become feasible without running the full generative model.
  • AR models that generate tokens in random orders remain compatible because the green list is global rather than derived from a hash of previously generated tokens.
  • The paper's ablation results indicate that the soft-bias variant balances image quality and detectability better than strict green-token enforcement, which can fail to produce coherent images at low green ratios.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper's experiments, the same token-map signal should survive any attack that leaves the discrete token sequence mostly intact, which suggests that heavy compression and spatial edits may be harder to defend than the paper's reported JPEG 25 setting; conversely, attacks that deliberately re-quantize to a different codebook partition could be a promising removal strategy.
  • The paper's observation that VAR's largest-scale token map is the main watermark carrier implies that a regeneration attack tuned to suppress high-frequency detail could preferentially target that scale; testing LBW under such a scale-aware attack would stress the method more directly than the current aggregate regeneration metrics.
  • Because the scheme only depends on VQ-VAE token consistency and a balanced green-list pool, it is plausible that it transfers to discrete-latent video or multimodal AR generators, but that transfer is not demonstrated in the paper and would need re-validation of the token-consistency observation.
  • An attacker who knows the green-list pool could in principle search for a token map that minimizes the maximum green-token ratio across all lists; the paper does not evaluate LBW against an adversary with full knowledge of the pool, only against the frequency-based estimation attacks the multi-list design targets.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes Lexical Bias Watermarking (LBW), a watermarking framework for autoregressive (AR) image generation models. Watermarks are embedded by biasing token sampling toward a predefined green list of codebook tokens, with a hard variant, a soft-bias variant, and a post-hoc token-substitution variant. Detection re-encodes the image into a token map and applies a one-proportion z-test on the number of green tokens. A multi-green-list matrix is introduced to reduce statistical distinguishability against white-box attackers. Experiments on VQ-GAN, VAR, and RAR compare LBW with classical and diffusion-native baselines under conventional attacks and regeneration attacks (VAE reconstruction, DiffPure, CtrlRegen), reporting high AUC and TPR@1%FPR, with LBW-Post on RAR claimed to be the state of the art against regeneration attacks.

Significance. If the results hold, this is a valuable first step toward in-generation watermarking for AR image generators, a setting where diffusion-native methods do not apply. The token-map embedding idea is well motivated by the token-consistency observation, the post-hoc extension is simple and practical, and the multi-green-list design is a sensible defense against distributional watermark-estimation attacks. The appendix provides extensive ablations over the green-list ratio and bias strength. However, the headline regeneration-robustness result is internally inconsistent between the main table and the appendix, and the detection statistic is not properly calibrated under the multi-green-list maximum rule; these issues must be resolved before the central claims can be accepted. The paper does not provide code or machine-checked proofs, but the experimental coverage is broad.

major comments (5)
  1. [Section 4.2, Table 1 vs. Appendix D, Table 2] The headline claim that LBW-Post on RAR attains a regeneration-attack average AUC of 0.995 and TPR@1%FPR of 0.937, significantly outperforming WatermarkDM, is not reproducible from the appendix's own default configuration. Table 1 (RAR, LBW-Post, CtrlRegen) reports AUC 0.988 and T@1F 0.850, while Table 2 with gamma=0.100, the value explicitly set as the default in Section 4.1, reports CtrlRegen AUC 0.870 and T@1F 0.240. Averaging the Table 2 values for VAE (1.000/1.000), DiffPure (0.993/0.920), and CtrlRegen (0.870/0.240) gives approximately AUC 0.954 and T@1F 0.720, not 0.995/0.937. This direct contradiction in the central result must be corrected or carefully explained.
  2. [Section 3.3, multi-green-list detection] Detection is performed by computing the green-token proportion for each of the N green lists and taking the maximum to form the z-score, yet Eq. (6) gives the z-score for a single green list under the null. Under the null hypothesis, the maximum of N=32 correlated z-statistics has a distribution with a substantially larger mean and heavier right tail, so the nominal threshold z_th for 1% FPR is not valid. The paper reports TPR@1%FPR throughout but does not state whether the threshold was recalibrated empirically. If it was, the calibration procedure and the resulting threshold should be described; if it was not, the false-positive rates are understated and all T@1F numbers require revision.
  3. [Section 4.1, Table 1] Tree-Ring and WatermarkDM are in-generation watermarking methods designed for diffusion models. The paper does not explain how these baselines were adapted to watermark images produced by autoregressive models. If they were applied post-hoc to the final images, that is not an in-generation comparison and would put them at a disadvantage; if some adaptation to AR token prediction was used, that adaptation is not described. As written, the comparative evaluation against these baselines is not well-defined.
  4. [Section 3.2, Observation 1 and Eq. (6)] Observation 1 establishes token consistency only for clean input images and their reconstructions. Detection after attacks requires that the watermark survive such that the re-encoded token map from the attacked image still contains a sufficient number of green tokens. The paper does not report token-consistency measurements between the watermarked token map and the token map re-encoded after VAE, DiffPure, or CtrlRegen attacks, so it is not empirically established that the detection signal in Eq. (6) survives these attacks. Such measurements for the default configurations would directly support the claimed mechanism.
  5. [Eq. (6)] The z-test assumes that, under the null, each token is an independent Bernoulli draw with probability gamma of being green. VQ token maps exhibit strong spatial structure and autoregressive dependencies, so the variance of the green-token count can deviate substantially from gamma(1-gamma) h w. The paper does not validate the null distribution of z-scores empirically on clean images for each model. Because the FPR calibration depends on this assumption, the validity of the reported T@1F values is not established without such validation.
minor comments (5)
  1. [Section 4.3] The sentence 'effectively eliminating distinguishable statistical cues and rendering frequency-based attacks' is incomplete; presumably the intended meaning is 'rendering frequency-based attacks ineffective.'
  2. [Throughout] The method name is inconsistent: the abstract and most of the paper use LBW, but Section 1's contributions and Table 1 use LBX, LBX-Hard, and LBX-Soft. Please unify the notation.
  3. [Section 4.1 and Appendix D] DiffPure is cited as [23], but reference [23] in the bibliography is the Transfusion paper; the correct reference for DiffPure is [30] (Nie et al.). The same citation error appears in Appendix D.
  4. [Algorithm 1] The convergence criterion for the green-list matrix generation is described only as 'until convergence or maximum iterations reached'; please specify the actual stopping condition and the number of iterations used in the experiments.
  5. [Title page] The title on the first page reads 'A N Approach Resistant to Regeneration Attack'; the article's metadata title uses 'An Approach.' Please correct the typographical spacing.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: LBW's embedding-detection identity is the intended watermark protocol, and its robustness claims are evaluated against external attacks and baselines.

full rationale

The paper's derivation chain is not circular. The embedding step (Eq. 7 for soft biasing, Eq. 8 for post-hoc substitution) deliberately increases the proportion of green-list tokens in the generated or reconstructed token map, and detection (Eq. 6) measures exactly that proportion after re-quantization. This identity between the embedding statistic and the detection statistic is the designed watermark protocol, not a hidden equivalence between a claimed prediction and its input. Observation 1 (token consistency under re-encoding) is an independent empirical measurement made before watermarking, and the robustness claims are evaluated against external attacks (Gaussian noise, blur, ColorJitter, geometric transforms, JPEG, VAE reconstruction, DiffPure, CtrlRegen) and external baselines (DwtDct, DwtDctSvd, RivaGAN, SSL, Tree-Ring, WatermarkDM). The multi-green-list design is validated by comparing the resulting token-frequency distribution to clean images, which checks a design property rather than deriving the main result from itself. The only notable self-citation, CtrlRegen from the same research group, is used as an attack benchmark and not as a load-bearing justification of LBW's correctness. I did observe an internal numerical inconsistency: the appendix's default RAR LBW-Post row (Table 2, gamma=0.1) reports CtrlRegen AUC/T@1F of 0.870/0.240, while Table 1 reports 0.988/0.850 for the same setting, and the advertised regeneration average 0.995/0.937 cannot be reproduced from the appendix values. This is a reproducibility and correctness concern for the main robustness claim, but it is not circularity because the advertised numbers are empirical results whose source values disagree rather than results derived from the method's own assumptions.

Assumptions & free parameters 4 free parameters · 4 assumptions · 1 invented entities

The method's contribution is the transfer of lexical biasing to AR image token maps. Its core parameters are tuned on the evaluation setup, and its detection premise relies on empirical token consistency, so the ledger is dominated by domain assumptions rather than free-floating invented entities.

free parameters (4)
  • green list ratio gamma = 0.2 for VQ-GAN, 0.1 for VAR and RAR (hard and soft variants use per-model values)
    Tuned via ablation in Fig. 4; lower gamma improves robustness but can hurt image quality and generation success.
  • soft bias constant sigma = 7 for VAR, 4 for VQ-GAN, 8 for RAR
    Selected from ablation in Fig. 4 to balance detectability and image fidelity.
  • number of green lists N = 32
    Chosen from Fig. 5 as the smallest value where the token frequency distribution matches clean images.
  • detection threshold zth = not reported
    The paper defines a z-score test but does not state the operating threshold used for real detection; AUC and TPR@1FPR are threshold-independent evaluations.
assumptions (4)
  • domain assumption Re-encoding an AR-generated image recovers a significant portion of the original token map.
    Observation 1, Section 3.2 and Fig. 1; without this, detection via re-quantization fails.
  • domain assumption The number of green tokens in a clean token map is binomially distributed with mean gamma times n and variance gamma(1-gamma) times n.
    Eq. 6 assumes independent token draws, but token maps have strong spatial and categorical dependencies.
  • domain assumption Soft logit biasing with constant sigma preserves image quality and token consistency.
    Section 3.3 and Fig. 8; hard masking of red tokens harms quality, so the soft variant is used.
  • domain assumption A pool of 32 balanced green lists makes watermarked token frequency indistinguishable from clean.
    Fig. 5; the balancing constraints in Eq. 9 are only approximately satisfied by Algorithm 1.
invented entities (1)
  • Green list pool matrix M independent evidence
    purpose: Contains 32 random green lists used to hide which tokens are watermarked from white-box adversaries.
    Algorithmic construct; evidence is empirical indistinguishability in Fig. 5 and robustness tables, not an external falsifiable prediction.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Autoregressive Images Watermarking through Lexical Biasing: An Approach Resistant to Regeneration Attack." pith.science (2026). https://pith.science/paper/4UTRJIAW

@misc{pith2026250601011,
  author       = {Pith},
  title        = {Pith review of: Autoregressive Images Watermarking through Lexical Biasing: An Approach Resistant to Regeneration Attack},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4UTRJIAW}},
  note         = {Machine review of arXiv:2506.01011}
}
read the original abstract

Autoregressive (AR) image generation models have gained increasing attention for their breakthroughs in synthesis quality, highlighting the need for robust watermarking to prevent misuse. However, existing in-generation watermarking techniques are primarily designed for diffusion models, where watermarks are embedded within diffusion latent states. This design poses significant challenges for direct adaptation to AR models, which generate images sequentially through token prediction. Moreover, diffusion-based regeneration attacks can effectively erase such watermarks by perturbing diffusion latent states. To address these challenges, we propose Lexical Bias Watermarking (LBW), a novel framework designed for AR models that resists regeneration attacks. LBW embeds watermarks directly into token maps by biasing token selection toward a predefined green list during generation. This approach ensures seamless integration with existing AR models and extends naturally to post-hoc watermarking. To increase the security against white-box attacks, instead of using a single green list, the green list for each image is randomly sampled from a pool of green lists. Watermark detection is performed via quantization and statistical analysis of the token distribution. Extensive experiments demonstrate that LBW achieves superior watermark robustness, particularly in resisting regeneration attacks.

Figures

Figures reproduced from arXiv: 2506.01011 by the authors.

Figure 1
Figure 1. Observation 1: Token consistency for VQ-GAN, VAR, and RAR across various codebook ratios ranging from 0.1 to 1.0. by subtracting the aggregated sum of the reconstructed residual feature maps from preceding scales (each upscaled to the maximum resolution) from the original feature map: rk =f − k X−1 i=1 interpolate( ˆri , hK, wK), rˆk =lookup(Z, qk), (3) where rˆk denotes the approximated residual feature map at scal… view at source ↗
Figure 2
Figure 2. Observation 2: Image quality metrics (PSNR, SSIM, and FID) for AR reconstructed images across various codebook sizes, ranging from 0.1 to 1.0. Original VQ-GAN VAR RAR Original VQ-GAN VAR RAR [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Reconstructed images using only 10% of the original codebook size. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Impact of γ and σ in robustness against Conventional (Con) and Regeneration (Reg) attacks. 8 [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Comparison of token frequency distributions with varying green list number [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Quantitative evaluation of visual quality for our LBW with varying γ and σ. Subfigures (a), (b), and (c) present PSNR, SSIM, and FID metrics for the LBW-Post watermark applied on VQ-GAN, VAR, and RAR models, while (d) and (e) show FID for our LBW-Hard and LBW-Soft, res…
Figure 7
Figure 7. Figure 7: Qualitative evaluation of visual quality for our LBW with varying γ and σ presents the results of LBW-Soft. The image quality improves with increasing γ for both LBW-Post and LBW-Hard. For LBW-Soft, reducing the noise parameter σ enhances image quality. When γ is low (…
Figure 8
Figure 8. Figure 8: Token consistency with varying γ. ColorJitter perturbations involving randomly applying hue adjustments (0.3), saturation scaling (3.0), and contrast scal￾ing (3.0), (3) Geometric transformations (Crop&Resize: 0.7, Random Rotation: 0 ◦ -180◦ ), and (4) JPEG compression…
Figure 9
Figure 9. Figure 9: Comparison between watermark images produced by LBW-Hard and LBW-Soft. [PITH_FULL_IMAGE:figures/full_fig_p015_9.png]
Figure 10
Figure 10. Figure 10: Visual comparison between our LBW-Post and other Post-hoc methods. [PITH_FULL_IMAGE:figures/full_fig_p015_10.png]
Figure 11
Figure 11. Figure 11: Comparison between LBW-Hard and LBW-Soft across VAR, VQ-GAN, and RAR. [PITH_FULL_IMAGE:figures/full_fig_p019_11.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

57 extracted references · 20 canonical work pages

  1. [1]

    Sdxl: Improving latent diffusion models for high-resolution image synthesis

    Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis. arXiv preprint arXiv:2307.01952, 2023

    arXiv 2023

  2. [2]

    Scaling rectified flow transformers for high-resolution image synthesis

    Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, et al. Scaling rectified flow transformers for high-resolution image synthesis. In Forty-first International Conference on Machine Learning, 2024

    2024

  3. [3]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022

    2022

  4. [4]

    Ssr-encoder: Encoding selective subject representation for subject-driven generation

    Yuxuan Zhang, Yiren Song, Jiaming Liu, Rui Wang, Jinpeng Yu, Hao Tang, Huaxia Li, Xu Tang, Yao Hu, Han Pan, et al. Ssr-encoder: Encoding selective subject representation for subject-driven generation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8069–8078, 2024

    2024

  5. [5]

    Fast personalized text to image synthesis with attention injection

    Yuxuan Zhang, Yiren Song, Jinpeng Yu, Han Pan, and Zhongliang Jing. Fast personalized text to image synthesis with attention injection. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 6195–6199. IEEE, 2024. 9 A PREPRINT - J UNE 3, 2025

    work page 2024

  6. [6]

    Easycontrol: Adding efficient and flexible control for diffusion transformer

    Yuxuan Zhang, Yirui Yuan, Yiren Song, Haofan Wang, and Jiaming Liu. Easycontrol: Adding efficient and flexible control for diffusion transformer. arXiv preprint arXiv:2503.07027, 2025

    arXiv 2025

  7. [7]

    Editworld: Simulating world dynamics for instruction-following image editing

    Ling Yang, Bohan Zeng, Jiaming Liu, Hong Li, Minghao Xu, Wentao Zhang, and Shuicheng Yan. Editworld: Simulating world dynamics for instruction-following image editing. arXiv preprint arXiv:2405.14785, 2024

    arXiv 2024

  8. [8]

    Photodoodle: Learning artistic image editing from few-shot pairwise data

    Shijie Huang, Yiren Song, Yuxuan Zhang, Hailong Guo, Xueyin Wang, Mike Zheng Shou, and Jiaming Liu. Photodoodle: Learning artistic image editing from few-shot pairwise data. arXiv preprint arXiv:2502.14397, 2025

    arXiv 2025

Show all 57 references
  1. [9]

    Seededit: Align image re-generation to image editing

    Yichun Shi, Peng Wang, and Weilin Huang. Seededit: Align image re-generation to image editing. arXiv preprint arXiv:2411.06686, 2024

    2024 arXiv

  2. [10]

    Imagic: Text-based real image editing with diffusion models

    Bahjat Kawar, Shiran Zada, Oran Lang, Omer Tov, Huiwen Chang, Tali Dekel, Inbar Mosseri, and Michal Irani. Imagic: Text-based real image editing with diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 6007–6017, 2023

    2023

  3. [11]

    Stable-makeup: When real-world makeup transfer meets diffusion model

    Yuxuan Zhang, Lifu Wei, Qing Zhang, Yiren Song, Jiaming Liu, Huaxia Li, Xu Tang, Yao Hu, and Haibo Zhao. Stable-makeup: When real-world makeup transfer meets diffusion model. arXiv preprint arXiv:2403.07764, 2024

    2024 arXiv

  4. [12]

    Stable-hair: Real-world hair transfer via diffusion model

    Yuxuan Zhang, Qing Zhang, Yiren Song, Jichao Zhang, Hao Tang, and Jiaming Liu. Stable-hair: Real-world hair transfer via diffusion model. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 10348–10356, 2025

    2025

  5. [13]

    Show-1: Marrying pixel and latent diffusion models for text-to-video generation

    David Junhao Zhang, Jay Zhangjie Wu, Jia-Wei Liu, Rui Zhao, Lingmin Ran, Yuchao Gu, Difei Gao, and Mike Zheng Shou. Show-1: Marrying pixel and latent diffusion models for text-to-video generation. International Journal of Computer Vision, pages 1–15, 2024

    2024

  6. [14]

    Makeanything: Harnessing diffusion transformers for multi-domain procedural sequence generation

    Yiren Song, Cheng Liu, and Mike Zheng Shou. Makeanything: Harnessing diffusion transformers for multi-domain procedural sequence generation. arXiv preprint arXiv:2502.01572, 2025

    2025 arXiv

  7. [15]

    Processpainter: Learn painting process from sequence data

    Yiren Song, Shijie Huang, Chen Yao, Xiaojun Ye, Hai Ci, Jiaming Liu, Yuxuan Zhang, and Mike Zheng Shou. Processpainter: Learn painting process from sequence data. arXiv preprint arXiv:2406.06062, 2024

    2024 arXiv

  8. [16]

    Grid: Visual layout generation

    Cong Wan, Xiangyang Luo, Zijian Cai, Yiren Song, Yunlong Zhao, Yifan Bai, Yuhang He, and Yihong Gong. Grid: Visual layout generation. arXiv preprint arXiv:2412.10718, 2024

    2024 arXiv

  9. [17]

    Black Forest Labs. Flux. https://github.com/black-forest-labs/flux , 2024

    2024

  10. [18]

    Improving image generation with better captions

    James Betker, Gabriel Goh, Li Jing, Tim Brooks, Jianfeng Wang, Linjie Li, Long Ouyang, Juntang Zhuang, Joyce Lee, Yufei Guo, et al. Improving image generation with better captions. Computer Science. https://cdn. openai. com/papers/dall-e-3. pdf, 2(3):8, 2023

    2023

  11. [19]

    Visual autoregressive modeling: Scalable image generation via next-scale prediction

    Keyu Tian, Yi Jiang, Zehuan Yuan, Bingyue Peng, and Liwei Wang. Visual autoregressive modeling: Scalable image generation via next-scale prediction. Advances in neural information processing systems, 37:84839–84865, 2025

    2025

  12. [20]

    Infinity: Scaling bitwise autoregressive modeling for high-resolution image synthesis

    Jian Han, Jinlai Liu, Yi Jiang, Bin Yan, Yuqi Zhang, Zehuan Yuan, Bingyue Peng, and Xiaobing Liu. Infinity: Scaling bitwise autoregressive modeling for high-resolution image synthesis. arXiv preprint arXiv:2412.04431, 2024

    2024 arXiv

  13. [21]

    Randomized autoregressive visual generation

    Qihang Yu, Ju He, Xueqing Deng, Xiaohui Shen, and Liang-Chieh Chen. Randomized autoregressive visual generation. arXiv preprint arXiv:2411.00776, 2024

    2024 arXiv

  14. [22]

    Show-o: One single transformer to unify multimodal understanding and generation, 2024

    Jinheng Xie, Weijia Mao, Zechen Bai, David Junhao Zhang, Weihao Wang, Kevin Qinghong Lin, Yuchao Gu, Zhijie Chen, Zhenheng Yang, and Mike Zheng Shou. Show-o: One single transformer to unify multimodal understanding and generation, 2024

    2024

  15. [23]

    Transfusion: Predict the next token and diffuse images with one multi-modal model, 2024

    Chunting Zhou, Lili Yu, Arun Babu, Kushal Tirumala, Michihiro Yasunaga, Leonid Shamis, Jacob Kahn, Xuezhe Ma, Luke Zettlemoyer, and Omer Levy. Transfusion: Predict the next token and diffuse images with one multi-modal model, 2024

    2024

  16. [24]

    Maklachur Rahman

    Md. Maklachur Rahman. A dwt, dct and svd based watermarking technique to protect the image piracy. Inter- national Journal of Managing Public Sector Information and Communication Technologies, 4(2):21–32, June 2013

    2013

  17. [25]

    Robust invisible video watermarking with attention, 2019

    Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention, 2019

    2019

  18. [26]

    Watermarking images in self-supervised latent spaces

    Pierre Fernandez, Alexandre Sablayrolles, Teddy Furon, Hervé Jégou, and Matthijs Douze. Watermarking images in self-supervised latent spaces. In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 3054–3058. IEEE, 2022. 10 ...

    2022

  19. [27]

    Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust

    Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust. arXiv preprint arXiv:2305.20030, 2023

    2023 arXiv

  20. [28]

    Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification

    Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification. In European Conference on Computer Vision, pages 338–354. Springer, 2024

    2024

  21. [29]

    Robin: Robust and invisible watermarks for diffusion models with adversarial optimization, 2024

    Huayang Huang, Yu Wu, and Qian Wang. Robin: Robust and invisible watermarks for diffusion models with adversarial optimization, 2024

    2024

  22. [30]

    Diffusion models for adversarial purification, 2022

    Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification, 2022

    2022

  23. [31]

    Image watermarks are removable using controllable regeneration from clean noise, 2024

    Yepeng Liu, Yiren Song, Hai Ci, Yu Zhang, Haofan Wang, Mike Zheng Shou, and Yuheng Bu. Image watermarks are removable using controllable regeneration from clean noise, 2024

    2024

  24. [32]

    On the reliability of watermarks for large language models

    John Kirchenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fernando, Aniruddha Saha, Micah Goldblum, and Tom Goldstein. On the reliability of watermarks for large language models. arXiv preprint arXiv:2306.04634, 2023

    2023 arXiv

  25. [33]

    Unbiased watermark for large language models

    Zhengmian Hu, Lichang Chen, Xidong Wu, Yihan Wu, Hongyang Zhang, and Heng Huang. Unbiased watermark for large language models. arXiv preprint arXiv:2310.10669, 2023

    2023 arXiv

  26. [34]

    Freeman, and Yu-Xiong Wang

    Ziqi Pang, Tianyuan Zhang, Fujun Luan, Yunze Man, Hao Tan, Kai Zhang, William T. Freeman, and Yu-Xiong Wang. Randar: Decoder-only autoregressive visual generation in random orders, 2024

    2024

  27. [35]

    Wolfgang and E.J

    R.B. Wolfgang and E.J. Delp. A watermark for digital images. In Proceedings of 3rd IEEE International Conference on Image Processing, volume 3, pages 219–222 vol.3, 1996

    1996

  28. [36]

    K. A. Navas, Mathews Cheriyan Ajay, M. Lekshmi, Tampy S. Archana, and M. Sasikumar. Dwt-dct-svd based watermarking. In 2008 3rd International Conference on Communication Systems Software and Middleware and Workshops (COMSWARE ’08), pages 271–274, 2008

    2008

  29. [37]

    Watermarking images in self-supervised latent spaces, 2022

    Pierre Fernandez, Alexandre Sablayrolles, Teddy Furon, Hervé Jégou, and Matthijs Douze. Watermarking images in self-supervised latent spaces, 2022

    2022

  30. [38]

    Stegastamp: Invisible hyperlinks in physical photographs

    Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical photographs. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2020

    2020

  31. [39]

    The stable signature: Rooting watermarks in latent diffusion models

    Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 22466–22477, October 2023

    2023

  32. [40]

    Wmadapter: Adding watermark control to latent diffusion models, 2024

    Hai Ci, Yiren Song, Pei Yang, Jinheng Xie, and Mike Zheng Shou. Wmadapter: Adding watermark control to latent diffusion models, 2024

    2024

  33. [41]

    A watermark for large language models

    John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning, pages 17061–17084. PMLR, 2023

    2023

  34. [42]

    An entropy-based text watermarking detection method

    Yijian Lu, Aiwei Liu, Dianzhi Yu, Jingjing Li, and Irwin King. An entropy-based text watermarking detection method. arXiv preprint arXiv:2403.13485, 2024

    2024 arXiv

  35. [43]

    Adaptive text watermark for large language models.arXiv preprint arXiv:2401.13927, 2024

    Yepeng Liu and Yuheng Bu. Adaptive text watermark for large language models.arXiv preprint arXiv:2401.13927, 2024

    2024 arXiv

  36. [44]

    Who wrote this code? watermarking for code generation, 2024

    Taehyun Lee, Seokhee Hong, Jaewoo Ahn, Ilgee Hong, Hwaran Lee, Sangdoo Yun, Jamin Shin, and Gunhee Kim. Who wrote this code? watermarking for code generation, 2024

    2024

  37. [45]

    Optimizing watermarks for large language models

    Bram Wouters. Optimizing watermarks for large language models. arXiv preprint arXiv:2312.17295, 2023

    2023 arXiv

  38. [46]

    A semantic invariant robust watermark for large language models, 2024

    Aiwei Liu, Leyi Pan, Xuming Hu, Shiao Meng, and Lijie Wen. A semantic invariant robust watermark for large language models, 2024

    2024

  39. [47]

    Can watermarks survive translation? on the cross-lingual consistency of text watermark for large language models

    Zhiwei He, Binglin Zhou, Hongkun Hao, Aiwei Liu, Xing Wang, Zhaopeng Tu, Zhuosheng Zhang, and Rui Wang. Can watermarks survive translation? on the cross-lingual consistency of text watermark for large language models. arXiv preprint arXiv:2402.14007, 2024

    2024 arXiv

  40. [48]

    Generative pretraining from pixels

    Mark Chen, Alec Radford, Rewon Child, Jeffrey Wu, Heewoo Jun, David Luan, and Ilya Sutskever. Generative pretraining from pixels. In International conference on machine learning, pages 1691–1703. PMLR, 2020

    2020

  41. [49]

    Deep autoregressive networks

    Karol Gregor, Ivo Danihelka, Andriy Mnih, Charles Blundell, and Daan Wierstra. Deep autoregressive networks. In International Conference on Machine Learning, pages 1242–1250. PMLR, 2014

    2014

  42. [50]

    Image transformer

    Niki Parmar, Ashish Vaswani, Jakob Uszkoreit, Lukasz Kaiser, Noam Shazeer, Alexander Ku, and Dustin Tran. Image transformer. In International conference on machine learning, pages 4055–4064. PMLR, 2018. 11 A PREPRINT - J UNE 3, 2025 (a) LBW-Post PSNR (b) LBW-Post SSIM (c) LBW-...

    2018

  43. [51]

    Neural discrete representation learning, 2018

    Aaron van den Oord, Oriol Vinyals, and Koray Kavukcuoglu. Neural discrete representation learning, 2018

    2018

  44. [52]

    Taming transformers for high-resolution image synthesis

    Patrick Esser, Robin Rombach, and Bjorn Ommer. Taming transformers for high-resolution image synthesis. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 12873–12883, 2021

    2021

  45. [53]

    Generating diverse high-fidelity images with vq-vae-2

    Ali Razavi, Aaron Van den Oord, and Oriol Vinyals. Generating diverse high-fidelity images with vq-vae-2. Advances in neural information processing systems, 32, 2019

    2019

  46. [54]

    Autoregressive image generation using residual quantization

    Doyup Lee, Chiheon Kim, Saehoon Kim, Minsu Cho, and Wook-Shin Han. Autoregressive image generation using residual quantization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 11523–11532, 2022

    2022

  47. [55]

    Neural discrete representation learning.Advances in neural information processing systems, 30, 2017

    Aaron Van Den Oord, Oriol Vinyals, et al. Neural discrete representation learning.Advances in neural information processing systems, 30, 2017

    2017

  48. [56]

    Combined dwt-dct digital image watermarking

    Ali Al-Haj. Combined dwt-dct digital image watermarking. Journal of computer science, 3(9):740–746, 2007

    2007

  49. [57]

    A recipe for watermarking diffusion models

    Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Ngai-Man Cheung, and Min Lin. A recipe for watermarking diffusion models. arXiv preprint arXiv:2303.10137, 2023. A Visual Quality Analysis This section presents a comprehensive analysis of the visual quality of the proposed waterm...

    2023 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.