pith. sign in

arxiv: 2503.12172 · v4 · pith:6DWLHGENnew · submitted 2025-03-15 · 💻 cs.LG · cs.CR· cs.CV

SEAL: Semantic Aware Image Watermarking

Kasra Arabi , R. Teal Witter , Chinmay Hegde , Niv Cohen This is my paper

Pith reviewed 2026-05-23 00:08 UTC · model grok-4.3

classification 💻 cs.LG cs.CRcs.CV
keywords image watermarkingsemantic embeddinglocality-sensitive hashingdiffusion modelsforgery attacksgenerative modelscontent-aware detection
0
0 comments X

The pith

Embedding semantic information into watermarks allows verification without a key database and improves robustness to forgery attacks on generated images.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper introduces a watermarking method for images from generative models that incorporates the image's own semantic content into the watermark pattern. This enables distortion-free embedding and detection by inferring the key from the image using locality-sensitive hashing on its semantic embedding, eliminating the need for a database of keys. By conditioning detection on the original content, the approach shows greater resistance to two forgery strategies: extracting the initial noise to generate new images with the same watermark, and inserting unrelated objects into the watermarked image. The results indicate that such content-aware watermarks can help distinguish or protect against risks from AI image generators.

Core claim

By embedding semantic information about the generated image directly into the watermark, the key pattern can be inferred from the semantic embedding using locality-sensitive hashing, allowing verification without a database of key patterns, and conditioning detection on image content improves robustness against forgery attacks such as noise extraction and object insertion.

What carries the argument

Semantic embedding of the image combined with locality-sensitive hashing to derive the watermark key pattern without database lookup.

If this is right

  • Watermark detection becomes possible without searching through dictionaries of used keys.
  • Verification is distortion-free and tied directly to the image content.
  • Robustness increases against attackers who extract initial noise to create new images with the same pattern.
  • Greater resistance to insertion of unrelated objects while attempting to preserve the watermark.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The method may scale to watermarking at very large volumes of generated images by removing database requirements.
  • It could be tested on non-diffusion generative models to check if semantic conditioning transfers.
  • Combining it with existing perceptual quality metrics might further reduce any residual distortion risks.

Load-bearing premise

Locality-sensitive hashing on the semantic embedding will reliably recover the correct key pattern without false positives or negatives.

What would settle it

A demonstration that locality-sensitive hashing on the semantic embedding produces a collision or mismatch leading to failed key recovery on a watermarked image, or that an attacker can successfully extract noise or insert an object to forge without detection.

Figures

Figures reproduced from arXiv: 2503.12172 by Chinmay Hegde, Kasra Arabi, Niv Cohen, R. Teal Witter.

Figure 1
Figure 1. Figure 1: Illustration of different watermarking frameworks using the initial noise of diffusion models. No Watermark: A diffusion model maps pure Gaussian noise to an image. Tree-Ring: A pattern is added to the initial noise, modifying the distribution of generated images in a detectable way. Key-Based Watermarking: A key is sampled to generate distortion-free images linked to the key. Ours (SEAL): The initial nois… view at source ↗
Figure 2
Figure 2. Figure 2: Illustration of the SEAL watermarking framework for diffusion models using semantic-aware noise patterns. Watermark Generation: A textual prompt (e.g., “Beach at sunset.”) is first embedded into a semantic space. The embedding is then processed using SimHash to generate discrete keys, which are used in Encrypted Sampling to choose the initial noise z ∼ N (0, I). The watermarked noise then undergoes standar… view at source ↗
Figure 3
Figure 3. Figure 3: Effect of the Cat Attack on SEAL. (Left) A cat image is pasted onto a watermarked image at a random position and scale. (Right) Our method detects this modification by identifying elevated ℓ2 norms in affected patches. Note that the displayed norms are rounded to the nearest integer. with the semantics of the input prompt (see Section 3.3). We describe our watermarking method in detail below. 3.2. Method F… view at source ↗
Figure 4
Figure 4. Figure 4: Watermark Detection vs. Semantic Similarity. We plot the empirical probability of detecting a watermark as a function of the angle between the semantic embedding used for watermark generation and that of the inspected image (n = 1024, b = 7). The table shows the analytical detection probabilities at key angles calculated by Lemma 3.2, illustrating how sharply SimHash distin￾guishes semantically related ima… view at source ↗
Figure 5
Figure 5. Figure 5: Ablation of Embedding Strategies for Watermark Detection. Comparison of angle separation between related and unrelated images using different embedding approaches. The raw image feature vector (left) fails to distinguish semantic relationships, while caption embeddings (center) substantially improve separation. Fine-tuning the embedding model (right) yields additional gains in detection accuracy. for angle… view at source ↗
Figure 6
Figure 6. Figure 6: Robustness of Watermark Detection Against Image Transformations. Comparison of correct watermark detection accuracy of SEAL under various image transformations. 7. Additional Related Works Post-Processing Methods. Post-processing techniques embed watermarks after the image generation stage, provid￾ing model-agnostic flexibility at the cost of potential quality degradation. Frequency-domain methods, such as… view at source ↗
Figure 7
Figure 7. Figure 7: Ablation Study of the Number of Patches (n) and Bits (b) on Watermark Detection Performance. Dataset (Gustavosta/Stable-Diffusion-Prompts). Images were generated using Stable Diffusion v2.1 (stabilityai/stable-diffusion-2-1-base), then captioned with BLIP-2 (Salesforce/blip2-flan-t5-xl). A regeneration loop used each caption as a prompt to generate a second image, which was again captioned, yielding semant… view at source ↗
Figure 8
Figure 8. Figure 8: Impact of Repetitive Patches in the Initial Noise on Image Generation. 13. Additional Experiments 13.1. CatAttack Performance vs. Object Scale We varied the size of the pasted object in the CatAttack from 10% to 40% of the image area and evaluated detection performance at each scale [PITH_FULL_IMAGE:figures/full_fig_p013_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Comparison between the proxy image x_{\text {pre}} (left two) and the final generated image x (right two). Zoom in for clarity. 13.2. Effect of Insertions on Semantic Embeddings and LSH Binning We evaluate how localized insertions (e.g., “cat”, “house”, “human”) impact the semantic embedding vector and its SimHash bin assignments [PITH_FULL_IMAGE:figures/full_fig_p014_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Watermarked images generated using SEAL. 5 [PITH_FULL_IMAGE:figures/full_fig_p015_10.png] view at source ↗
read the original abstract

Generative models have rapidly evolved to generate realistic outputs. However, their synthetic outputs increasingly challenge the clear distinction between natural and AI-generated content, necessitating robust watermarking techniques. Watermarks are typically expected to preserve the integrity of the target image, withstand removal attempts, and prevent unauthorized replication onto unrelated images. To address this need, recent methods embed persistent watermarks into images produced by diffusion models using the initial noise. Yet, to do so, they either distort the distribution of generated images or rely on searching through a long dictionary of used keys for detection. In this paper, we propose a novel watermarking method that embeds semantic information about the generated image directly into the watermark, enabling a distortion-free watermark that can be verified without requiring a database of key patterns. Instead, the key pattern can be inferred from the semantic embedding of the image using locality-sensitive hashing. Furthermore, conditioning the watermark detection on the original image content improves robustness against forgery attacks. To demonstrate that, we consider two largely overlooked attack strategies: (i) an attacker extracting the initial noise and generating a novel image with the same pattern; (ii) an attacker inserting an unrelated (potentially harmful) object into a watermarked image, possibly while preserving the watermark. We empirically validate our method's increased robustness to these attacks. Taken together, our results suggest that content-aware watermarks can mitigate risks arising from image-generative models.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

3 major / 1 minor

Summary. The paper proposes SEAL, a semantic-aware watermarking method for diffusion-generated images. It embeds semantic information about the image content into the watermark via locality-sensitive hashing (LSH) on semantic embeddings, enabling database-free detection by inferring the key pattern from the image itself. The central claim is that conditioning watermark detection on the original image content improves robustness against two forgery attacks: (i) extracting the initial noise to generate a new image using the same pattern, and (ii) inserting an unrelated object into a watermarked image (possibly while preserving the watermark). The abstract states that the method is distortion-free and that empirical validation demonstrates increased robustness to these attacks.

Significance. If the robustness claims hold after proper quantification and stability analysis, the approach would offer a meaningful contribution to watermarking for generative models by removing the need for key-pattern databases while addressing specific forgery vectors that exploit noise reuse or semantic edits.

major comments (3)
  1. [Abstract] Abstract: the claim of 'empirical validation' of increased robustness to the two attack strategies provides no quantitative results, metrics, error bars, dataset details, or baseline comparisons. This absence is load-bearing for the central robustness claim.
  2. [Abstract] Abstract (attacks paragraph): the robustness claim requires that LSH on the semantic embedding recovers the exact key used at embedding time. Attack (ii) explicitly perturbs semantics via unrelated object insertion, which changes the embedding and LSH bucket; no bound on collision probability, false-negative rate for legitimate images, or embedding stability under these edits is supplied.
  3. [Abstract] Abstract: attack (i) re-uses the key pattern on a different image whose semantics differ from the original; the manuscript supplies no analysis showing that LSH still matches the original key or that false-positive rates across unrelated images remain negligible.
minor comments (1)
  1. [Abstract] The abstract refers to 'two largely overlooked attack strategies' without citing prior literature on noise-extraction or object-insertion attacks to substantiate the claim of oversight.

Simulated Author's Rebuttal

3 responses · 0 unresolved

We thank the referee for the constructive feedback on our manuscript. We address each major comment point by point below, clarifying the presentation in the abstract and the nature of our empirical and analytical support for the robustness claims.

read point-by-point responses

  1. Referee: [Abstract] Abstract: the claim of 'empirical validation' of increased robustness to the two attack strategies provides no quantitative results, metrics, error bars, dataset details, or baseline comparisons. This absence is load-bearing for the central robustness claim.

    Authors: The abstract serves as a concise summary and therefore omits specific numerical results. The full manuscript presents the empirical validation in Section 4, including quantitative metrics, error bars, dataset details, and baseline comparisons. We will revise the abstract to incorporate a brief reference to these key quantitative outcomes. revision: yes

  2. Referee: [Abstract] Abstract (attacks paragraph): the robustness claim requires that LSH on the semantic embedding recovers the exact key used at embedding time. Attack (ii) explicitly perturbs semantics via unrelated object insertion, which changes the embedding and LSH bucket; no bound on collision probability, false-negative rate for legitimate images, or embedding stability under these edits is supplied.

    Authors: We acknowledge that the manuscript does not supply theoretical bounds on collision probability or false-negative rates. Our contribution centers on empirical demonstration of LSH stability under the specified semantic edits, as shown in the experiments. We will add a dedicated discussion paragraph on LSH collision properties and observed stability in the revised version. revision: yes

  3. Referee: [Abstract] Abstract: attack (i) re-uses the key pattern on a different image whose semantics differ from the original; the manuscript supplies no analysis showing that LSH still matches the original key or that false-positive rates across unrelated images remain negligible.

    Authors: The manuscript provides empirical results demonstrating successful key recovery via LSH for attack (i) and reports false-positive behavior on unrelated images. We agree that an expanded explicit analysis of these rates would strengthen the presentation and will include it in the revised manuscript. revision: yes

Circularity Check

0 steps flagged

No circularity: method uses standard LSH on external semantic embeddings

full rationale

The paper proposes embedding semantic information via LSH on image embeddings for database-free detection and claims improved robustness to two forgery attacks. This relies on established LSH properties and semantic embedding models from prior literature, with empirical validation rather than any derivation that reduces to the authors' own inputs by construction. No self-definitional equations, fitted parameters renamed as predictions, or load-bearing self-citations appear in the abstract or description. The central claim remains independent of the paper's own fitted values.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

The method relies on standard assumptions from diffusion models and hashing literature; no free parameters, axioms, or invented entities are explicitly introduced or fitted in the abstract description.

pith-pipeline@v0.9.0 · 5791 in / 1119 out tokens · 32205 ms · 2026-05-23T00:08:59.517427+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 3 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. PGID: Progressive Guided Inversion and Denoising for Robust Watermark Detection

    cs.CV 2026-05 unverdicted novelty 6.0

    PGID restores watermark detection in diffusion models by using progressive inversion-denoising cycles to correct latents displaced by removal or forgery attacks.

  2. Removing the Watermark Is Not Enough: Forensic Stealth in Generative-AI Watermark Removal

    cs.CR 2026-05 unverdicted novelty 6.0

    Current AI image watermark removal attacks replace the watermark with a different forensic signal, allowing independent detectors to distinguish processed outputs from clean images at over 98% true-positive rate under...

  3. Dual-Guard: Dual-Channel Latent Watermarking for Provenance and Tamper Localization in Diffusion Images

    cs.CR 2026-04 unverdicted novelty 6.0

    Dual-Guard embeds complementary watermarks in diffusion image generation to verify provenance and localize tampering with low error rates on a 2400-sample benchmark under reprompting and editing attacks.

Reference graph

Works this paper leans on

44 extracted references · 44 canonical work pages · cited by 3 Pith papers · 1 internal anchor

  1. [1]

    Combined dwt-dct digital image watermarking

    Ali Al-Haj. Combined dwt-dct digital image watermarking. Journal of computer science, 3(9):740–746, 2007. 1

    work page 2007

  2. [2]

    Waves: Bench- marking the robustness of image watermarks

    Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, et al. Waves: Bench- marking the robustness of image watermarks. arXiv preprint arXiv:2401.08573, 2024. 1, 2

    work page arXiv 2024

  3. [3]

    Near-optimal hashing algo- rithms for approximate nearest neighbor in high dimensions

    Alexandr Andoni and Piotr Indyk. Near-optimal hashing algo- rithms for approximate nearest neighbor in high dimensions. Communications of the ACM, 51(1):117–122, 2008. 3

    work page 2008

  4. [4]

    Hidden in the noise: Two-stage robust water- marking for images

    Kasra Arabi, Benjamin Feuer, R Teal Witter, Chinmay Hegde, and Niv Cohen. Hidden in the noise: Two-stage robust water- marking for images. arXiv preprint arXiv:2412.04653, 2024. 1, 2, 7, 8, 3

    work page arXiv 2024

  5. [5]

    Ty- pology of risks of generative text-to-image models

    Charlotte Bird, Eddie Ungless, and Atoosa Kasirzadeh. Ty- pology of risks of generative text-to-image models. In Pro- ceedings of the 2023 AAAI/ACM Conference on AI, Ethics, and Society, pages 396–410, 2023. 1, 3

    work page 2023

  6. [6]

    Trustmark: Universal watermarking for arbitrary resolution images, 2023

    Tu Bui, Shruti Agarwal, and John Collomosse. Trustmark: Universal watermarking for arbitrary resolution images, 2023. 4

    work page 2023

  7. [7]

    Similarity estimation techniques from rounding algorithms

    Moses S Charikar. Similarity estimation techniques from rounding algorithms. In Proceedings of the thiry-fourth an- nual ACM symposium on Theory of computing, pages 380– 388, 2002. 5, 1

    work page 2002

  8. [8]

    Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification

    Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification. In European Conference on Computer Vision, pages 338–354. Springer, 2024. 2, 7

    work page 2024

  9. [9]

    Locality-sensitive hashing scheme based on p- stable distributions

    Mayur Datar, Nicole Immorlica, Piotr Indyk, and Vahab S Mirrokni. Locality-sensitive hashing scheme based on p- stable distributions. In Proceedings of the twentieth an- nual symposium on Computational geometry, pages 253–262,

    work page

  10. [10]

    Swift: Semantic watermarking for image forgery thwarting

    Gautier Evennou, Vivien Chappelier, Ewa Kijak, and Teddy Furon. Swift: Semantic watermarking for image forgery thwarting. In 2024 IEEE International Workshop on Informa- tion Forensics and Security (WIFS), pages 1–6. IEEE, 2024. 4

    work page 2024

  11. [11]

    Watermarking images in self-supervised latent spaces

    Pierre Fernandez, Alexandre Sablayrolles, Teddy Furon, Herv´e J ´egou, and Matthijs Douze. Watermarking images in self-supervised latent spaces. In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 3054–3058. IEEE, 2022. 1

    work page 2022

  12. [12]

    The stable signature: Rooting watermarks in latent diffusion models

    Pierre Fernandez, Guillaume Couairon, Herv´e J´egou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 22466–22477, 2023. 1, 2, 4

    work page 2023

  13. [13]

    Simi- larity search in high dimensions via hashing

    Aristides Gionis, Piotr Indyk, Rajeev Motwani, et al. Simi- larity search in high dimensions via hashing. In Vldb, pages 518–529, 1999. 2

    work page 1999

  14. [14]

    An unde- tectable watermark for generative image models

    Sam Gunn, Xuandong Zhao, and Dawn Song. An unde- tectable watermark for generative image models. arXiv preprint arXiv:2410.07369, 2024. 2, 8, 3

    work page arXiv 2024

  15. [15]

    Approximate nearest neigh- bors: towards removing the curse of dimensionality

    Piotr Indyk and Rajeev Motwani. Approximate nearest neigh- bors: towards removing the curse of dimensionality. In Pro- ceedings of the thirtieth annual ACM symposium on Theory of computing, pages 604–613, 1998. 2

    work page 1998

  16. [16]

    Misinformation, disinformation, and generative ai: Implications for perception and policy

    Kokil Jaidka, Tsuhan Chen, Simon Chesterman, Wynne Hsu, Min-Yen Kan, Mohan Kankanhalli, Mong Li Lee, Gyula Seres, Terence Sim, Araz Taeihagh, et al. Misinformation, disinformation, and generative ai: Implications for perception and policy. Digital Government: Research and Practice, 6 (1):1–15, 2025. 1

    work page 2025

  17. [17]

    Forging and removing latent-noise dif- fusion watermarks using a single image

    Anubhav Jain, Yuya Kobayashi, Naoki Murata, Yuhta Takida, Takashi Shibuya, Yuki Mitsufuji, Niv Cohen, Nasir Memon, and Julian Togelius. Forging and removing latent-noise dif- fusion watermarks using a single image. arXiv preprint arXiv:2504.20111, 2025. 2, 7

    work page arXiv 2025

  18. [18]

    Wouaf: Weight modulation for user attri- bution and fingerprinting in text-to-image diffusion models,

    Changhoon Kim, Kyle Min, Maitreya Patel, Sheng Cheng, and Yezhou Yang. Wouaf: Weight modulation for user attri- bution and fingerprinting in text-to-image diffusion models,

    work page

  19. [19]

    Blip- 2: Bootstrapping language-image pre-training with frozen image encoders and large language models

    Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. Blip- 2: Bootstrapping language-image pre-training with frozen image encoders and large language models. In International conference on machine learning, pages 19730–19742. PMLR,

    work page

  20. [20]

    Microsoft coco: Common objects in context

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll´ar, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer vision–ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, proceedings, part v 13, pages 740–755. Springer, 2014. 5

    work page 2014

  21. [21]

    Prompting hard or hardly prompting: Prompt inversion for text-to-image diffusion models

    Shweta Mahajan, Tanzila Rahman, Kwang Moo Yi, and Leonid Sigal. Prompting hard or hardly prompting: Prompt inversion for text-to-image diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6808–6817, 2024. 3

    work page 2024

  22. [22]

    Black-box forgery attacks on seman- tic watermarks for diffusion models

    Andreas M¨uller, Denis Lukovnikov, Jonas Thietke, Asja Fis- cher, and Erwin Quiring. Black-box forgery attacks on seman- tic watermarks for diffusion models. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 20937–20946, 2025. 2, 7

    work page 2025

  23. [23]

    Dwt-dct-svd based watermark- ing

    KA Navas, Mathews Cheriyan Ajay, M Lekshmi, Tampy S Archana, and M Sasikumar. Dwt-dct-svd based watermark- ing. In 2008 3rd international conference on communica- tion systems software and middleware and workshops (COM- SWARE’08), pages 271–274. IEEE, 2008. 1

    work page 2008

  24. [24]

    Sentence-bert: Sentence embeddings using siamese bert-networks

    Nils Reimers and Iryna Gurevych. Sentence-bert: Sentence embeddings using siamese bert-networks. In Proceedings of the 2019 Conference on Empirical Methods in Natural Lan- guage Processing. Association for Computational Linguistics,

    work page 2019

  25. [25]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022. 7

    work page 2022

  26. [26]

    Watermark anything with localized messages

    Tom Sander, Pierre Fernandez, Alain Durmus, Teddy Furon, and Matthijs Douze. Watermark anything with localized messages. arXiv preprint arXiv:2411.07231, 2024. 2, 7 9

    work page arXiv 2024

  27. [27]

    Stable-diffusion-prompts

    Gustavo Santana. Stable-diffusion-prompts. https : / / huggingface . co / datasets / Gustavosta / Stable-Diffusion-Prompts, 2024. Accessed: 2024- 11-20. 7, 5

    work page 2024

  28. [28]

    arXiv preprint arXiv:2306.05949 , year=

    Irene Solaiman, Zeerak Talat, William Agnew, Lama Ahmad, Dylan Baker, Su Lin Blodgett, Canyu Chen, Hal Daum´e III, Jesse Dodge, Isabella Duan, et al. Evaluating the social impact of generative ai systems in systems and society. arXiv preprint arXiv:2306.05949, 2023. 1

    work page arXiv 2023

  29. [29]

    Denoising Diffusion Implicit Models

    Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502,

    work page internal anchor Pith review Pith/arXiv arXiv 2010

  30. [30]

    Stegastamp: Invisible hyperlinks in physical photographs

    Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical photographs. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2117–2126, 2020. 1

    work page 2020

  31. [31]

    Tree-ring watermarks: Fingerprints for diffu- sion images that are invisible and robust

    Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fingerprints for diffu- sion images that are invisible and robust. arXiv preprint arXiv:2305.20030, 2023. 1, 2, 7, 8

    work page arXiv 2023

  32. [32]

    Can simple averaging defeat modern watermarks? Advances in Neural Information Processing Systems , 37:56644–56673,

    Pei Yang, Hai Ci, Yiren Song, and Mike Zheng Shou. Can simple averaging defeat modern watermarks? Advances in Neural Information Processing Systems , 37:56644–56673,

    work page

  33. [33]

    Ste- ganalysis on digital watermarking: Is your defense truly im- pervious? arXiv preprint arXiv:2406.09026, 2024

    Pei Yang, Hai Ci, Yiren Song, and Mike Zheng Shou. Ste- ganalysis on digital watermarking: Is your defense truly im- pervious? arXiv preprint arXiv:2406.09026, 2024. 8

    work page arXiv 2024

  34. [34]

    Gaussian shading: Provable performance-lossless image watermarking for diffusion mod- els

    Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weim- ing Zhang, and Nenghai Yu. Gaussian shading: Provable performance-lossless image watermarking for diffusion mod- els. In Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition, pages 12162–12171,

    work page

  35. [35]

    Editguard: Versatile image watermarking for tamper localization and copyright protection

    Xuanyu Zhang, Runyi Li, Jiwen Yu, Youmin Xu, Weiqi Li, and Jian Zhang. Editguard: Versatile image watermarking for tamper localization and copyright protection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 11964–11974, 2024. 2, 7

    work page 2024

  36. [36]

    Invisible image watermarks are provably removable using generative ai

    Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu- Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative ai. Advances in Neural Information Processing Systems, 37:8643–8672, 2025. 1, 2, 8, 4

    work page 2025

  37. [37]

    Hidden: Hiding data with deep networks

    Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In Proceedings of the European conference on computer vision (ECCV), pages 657–672, 2018. 1, 4 10 SEAL: Semantic Aware Image Watermarking Supplementary Material Clean Rotate JPEG C&S Blur Noise Bright Image Transformation 0.0 0.2 0.4 0.6 0.8 1.0 Detection Ac...

    work page 2018

  38. [38]

    Post-processing techniques embed watermarks after the image generation stage, provid- ing model-agnostic flexibility at the cost of potential quality degradation

    Additional Related Works Post-Processing Methods. Post-processing techniques embed watermarks after the image generation stage, provid- ing model-agnostic flexibility at the cost of potential quality degradation. Frequency-domain methods, such as methods using the Discrete Wavelet Transform (DWT) and Discrete Cosine Transform (DCT) [1, 23], embed watermar...

    work page

  39. [39]

    Proof of Lemma 3.2 Proof of Lemma 3.2. The angle between the original seman- tic vector v used to generate the watermark and extracted semantic vector ˜v of the suspect image is θ(v, ˜v) = cos−1 ⟨v, ˜v⟩ ∥v∥2∥˜v∥2 ∈ [−90◦, 90◦]. By the property of SimHash 1 and Assumption 3.1, the 1See Section 3 of [7] for details on why Pr r∼N (0,I) (sign(⟨v, r⟩) = sign(⟨...

    work page

  40. [40]

    Implementation Details 9.1. Key Parameters Unless otherwise stated, the results are reported with the following parameters: number of patch matching threshold nmatch = 12; patch-wise matching threshold τ = 2.3; num- ber of projection per noise patch: b = 7; number of noise patches k = 1024. All parameters were chosen to optimize the overall performance. 9...

    work page 2000

  41. [41]

    The results are presented in Figure 7

    Ablation of Number of Patches and Bits To investigate the impact of the number of patches (n) and the number of bits (b) used to generate the initial noise, we conducted an exhaustive ablation study across various parameter combinations. The results are presented in Figure 7

    work page

  42. [42]

    This attack aims to adversarially perturb non-watermarked images such that they appear watermarked by mimicking the latent representation of an originally watermarked image

    Resilience to Latent Forgery Attacks We evaluate SEAL under the Latent Forgery Attack [17]. This attack aims to adversarially perturb non-watermarked images such that they appear watermarked by mimicking the latent representation of an originally watermarked image. This type of attacks assumes access to at least one watermarked image and attempts to shift...

    work page

  43. [43]

    Additional Limitations and Discussion Distortion-Free Property for Sets of Images Our watermarking scheme securely generates the noise for each patch from a normal distribution, ensuring that each individual noise is distributed from a normal distribution. However, multiple watermarked images corresponding to related prompts may leak information about the...

    work page

  44. [44]

    cat”, “house

    Additional Experiments 13.1. CatAttack Performance vs. Object Scale We varied the size of the pasted object in the CatAttack from 10% to 40% of the image area and evaluated detection performance at each scale. Table 4 reports the ROC-AUC (%) for each object scale, showing a gradual improvement from 95.4% at a 10% scale to 98.0% at a 40% scale. Table 4. Ca...

    work page