Pith. sign in

REVIEW 4 major objections 5 minor 49 references

AnchorMark: Robust Diffusion Watermarking via Latent-Space Rotation Synchrony

T0 review · 4 major / 5 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Rotating an image rotates its recovered latent by the same angle, a property that lets a latent anchor restore watermarked payloads after rotation attacks.

desk verdict A genuinely useful training-free rotation synchronization layer for inversion-based watermarking, with an unquantified residual in the theory and a few missing baselines before the broader claims fully land. read the letter →

arxiv 2607.27551 v1 pith:JH5WMTPK submitted 2026-07-30 cs.CR

Yuqi Qian , Yun Cao , Haocheng Fu , Haochen Zhao , Hong Zhang , Meineng Zhu This is my paper
classification cs.CR
keywords RotationSynchronylatent-spacewatermarkingdiffusionmodelsgeometricrobustnessphaseanchorinversion-basedestimation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that diffusion-model image watermarking can be made rotation-robust without retraining, by exploiting a property called Rotation Synchrony: rotating a generated image before latent recovery produces a recovered initial latent that is approximately the original latent rotated by the same angle. If true, an attacker cannot break the watermark simply by rotating the image, because the decoder can estimate and undo the rotation. The authors embed a compact multi-frequency phase anchor in the center of the initial latent, use it for coarse-to-fine angle estimation, then re-align the image and decode the payload with the original watermark decoder. They report near-perfect bit accuracy up to ±60° rotations and under combined attacks across several diffusion backbones, with little image-quality loss. The load-bearing assumption is that the residual deviation from ideal Rotation Synchrony is small enough in practice.

What carries the argument

The central object is the multi-frequency phase anchor: a set of sine–cosine channel pairs with angular frequencies k_j (here {1,3}) placed in the central s×s patch of the initial latent. Under a centered rotation by α, the anchor’s phase shifts by k_j α, giving a predictable analytic response that supports coarse-to-fine rotation search. The injection uses per-channel moment matching, weak mixing with strength λ, and post-mixing recalibration to preserve latent statistics. The other load-bearing piece is the residual-bounded Rotation Synchrony bound (Proposition 1), which justifies treating the recovered latent as a rotated copy of the original plus a small residual.

What would settle it

Measure the latent-matching profile Drec(α,β) on a diverse set of generated images under rotation with border cropping and JPEG compression; if the minimum occurs more than 1° away from the ground-truth angle for a substantial fraction of samples, the anchor correction fails.

Watch

Extended reading notes

Core claim

AnchorMark claims that an image-space rotation induces the same angular rotation in the recovered initial latent, formalized as a residual-bounded commutativity relation (Proposition 1). The proof decomposes the deviation into VAE-mediated rotation residual, accumulated inversion-vector-field rotation defect, and generation–inversion cycle error, and bounds it via Lipschitz continuity and a Gronwall argument. Empirically, the latent-matching profile between the recovered latent and rotated references attains its minimum near the ground-truth angle, confirming that the property is usable for angle estimation. Building on this, the method inserts a statistics-calibrated, multi-frequency phase

Load-bearing premise

The residual deviation from ideal Rotation Synchrony, denoted ξ_α, is small enough that the latent-matching minimum tracks the true rotation angle under real border handling and interpolation.

Editorial extensions

If this is right

  • If Rotation Synchrony holds, inversion-based multi-bit watermarking can be made rotation-robust without any training or modification to the diffusion model.
  • The anchor’s central placement and analytic phase response let the decoder estimate rotation angles over a wide range (tests go to ±60°), enabling near-perfect payload recovery.
  • The method is shown to work with two existing inversion-based watermarking schemes, and across multiple diffusion backbones, including under randomized combined attacks with resizing, JPEG, noise, or blur.
  • Because the payload decoder is unchanged and the anchor only occupies a compact central support, the approach preserves image quality and semantic fidelity (FID and CLIP-Score remain close to the unmarked baseline).
  • The same synchronization mechanism is modular: it can be added to any inversion-based watermarking method that uses spatially indexed latent carriers.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An immediate extension is to test whether analogous synchrony holds for translation, scaling, or affine transforms; if it does, a generalized anchor could handle composite geometric attacks without additional training.
  • The phase anchor is itself an added signal that an adversary could try to remove or spoof; the paper does not analyze adversarial anchor removal, so robustness under such targeted attacks remains an open question.
  • A direct measurement of the residual ξ_α (the deviation in Proposition 1) across diverse images and rotation angles would independently confirm the empirical matching profiles and sharpen the bound’s practical significance.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. AnchorMark proposes a training-free synchronization layer for inversion-based diffusion watermarks. The paper formalizes "Rotation Synchrony" (Definition 1): rotating a generated image before DDIM inversion approximately rotates the recovered initial latent by the same angle. It embeds a compact multi-frequency phase anchor in the central latent patch, uses coarse-to-fine anchor-guided rotation estimation, and then refines with the original watermark decoder's confidence. Experiments on SD2.1 (and other backbones for combined attacks) report that adding AnchorMark to Gaussian Shading and ShapeMark restores high bit accuracy under rotations up to ±60°, whereas the base methods fail. The paper includes an ablation of the anchor design and a combined-attack study across four backbones.

Significance. If the central claim holds, the contribution is practically valuable: it provides a modular, decoder-agnostic way to recover spatial alignment for inversion-based multi-bit watermarks without retraining, and it addresses a known failure mode. The paper's main empirical Tables 1–3 give direct within-paper comparisons, and the ablation of the phase-anchor design is informative. The core theoretical argument, however, is not yet quantitative enough to be load-bearing: Proposition 1 bounds a residual by unquantified terms, and Eq. (14) does not by itself guarantee that the matching argmin tracks the true angle. The manuscript currently supports its claim mainly through downstream matching plots and end-to-end accuracy, leaving the synchronization mechanism's robustness under the actual attack protocol not fully established.

major comments (4)
  1. [Residual-Bounded Rotation Synchrony, Prop. 1 / Eq. (9)] The paper's load-bearing claim is that the residual ξα is small enough for angle recovery. Proposition 1 bounds ||ξα|| by sums of unquantified terms: the VAE residual r_vae, the vector-field defect δ_s, the Lipschitz constants, and the cycle error. The text says the practical magnitude is "examined empirically below," but the later empirical section reports only downstream matching profiles (Fig. 3) and end-to-end accuracy. It never reports direct measurements of ||ξα||, Dideal well width/curvature, or the distribution of the argmin error before coarse-to-fine/refinement. Since border handling, interpolation, and 10-step DDIM inversion can all inflate these residuals at ±60°, this missing quantification is decisive. Please add direct residual-norm measurements under the exact attack protocol, together with the argmin-error distribution and, if possible, an estimate of the matching-profil
  2. [Rotation Estimation via Latent Matching, Eq. (14)] The reverse-triangle inequality in Eq. (14) is insufficient for the paper's conclusion. A bounded perturbation of the matching profile does not control the argmin unless εα is small relative to the height/curvature of the Dideal well. Diffusion initial latents are approximately statistically isotropic, so Dideal can be nearly flat away from β=α; a small residual component aligned with the rotation gradient could shift the minimum by several degrees. The paper should either provide a quantitative lower bound on the well's curvature or empirically measure the matching landscape (e.g., Dideal(α,β) for the actual latents and the distribution of the raw matching argmin) so that the reader can verify that the practical minimum is anchored near the true angle.
  3. [Experiments, Main Results (Table 1)] The rotation-attack protocol is not specified. It is unclear how rotation is implemented in the image domain: interpolation method, border fill, whether the image is cropped or re-scaled after rotation, and what the role of padding is. This is not a presentation nit: at ±60° the border effects dominate, and an anchor placed in the central patch can behave very differently under 'rotate-and-crop' versus 'rotate-with-padding without rescaling'. Without the protocol, the reported TPR/Acc numbers are not reproducible, and the comparison across methods is ambiguous. Please specify the exact rotation operator used for every table, and state whether any resizing/cropping is applied.
  4. [Experiments, Combined Attacks (Table 2)] Table 2 reports only AnchorMark-enhanced results (Gaussian Shading + AnchorMark, ShapeMark + AnchorMark). There is no column showing the unmodified base methods under the same randomized combined-attack protocol, so the reader cannot quantify how much robustness AnchorMark adds in this setting. Moreover, the related work cites SynTag (Fang et al. 2025a) as a learned synchronizer for inversion-based watermarks, but SynTag is never compared. Given that SynTag is the closest prior approach targeting the same geometric-robustness gap, omitting it weakens the paper's claim that AnchorMark fills the gap. Please add base-method baselines and, if feasible, a comparison to SynTag under the same protocol.
minor comments (5)
  1. [Empirical Validation of Rotation Synchrony (Fig. 3)] The figure caption and text say the matching profile attains a minimum at the ground-truth angle, but no error bars or quantitative values (e.g., minimum depth, distance at neighboring angles) are reported. A quantitative readout would help the reader assess the claim independently.
  2. [Ablation Study (Table 3)] The differences among anchor designs are small (e.g., angle error 0.398 vs 0.405 for Gaussian Shading), and no error bars or significance tests are given. As written, the conclusion that the full multi-frequency anchor is superior to the low-frequency-only variant is not supported by the displayed precision. Report standard errors over multiple runs or seeds.
  3. [Appendix / finite-step DDIM] The text refers to a "finite-step DDIM formulation and its discretization residual" in the appendix, but the supplied manuscript does not contain the appendix. This is a missing support item; please include it or remove the reference.
  4. [Evaluation Metrics] TPR is reported at FPR=10^-6, but the paper does not describe how this FPR is calibrated or how confidence values are computed for the payload-guided local refinement. Please clarify the statistical procedure, especially when Acc is also reported for methods without a verification confidence.
  5. [Definitions and notation] The notation Rα is used for both image-domain rotation (Eq. 1) and latent-domain rotation (Eq. 10), which can confuse the reader. Consider distinguishing R_α^{(img)} from R_α^{(lat)} or introducing explicit names.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: Rotation Synchrony is an empirically validated property, and the anchor's phase response is design-intrinsic, not a fitted prediction.

full rationale

The paper's central claim is that image-domain rotation propagates to the recovered initial latent as approximately the same angular rotation (Definition 1, Eq. (2)). This is not assumed as an input; it is formalized as a residual-bounded property in Proposition 1, and the residual is not set to zero or fitted. The actual support for the claim is empirical: Fig. 3 measures the matching profile and shows a low-distance diagonal at the ground-truth angle. The anchor's phase response in Eq. (20) is also not circular: it is an analytic construction property of the injected template (rotating the template shifts its phase by k_j alpha by definition), but the paper does not claim this equation alone proves the full image-to-latent rotation correspondence. The recovery pipeline relies on matching the recovered anchor against rotated references, and the decisive validation is the end-to-end accuracy under rotation attacks, tested not only on the authors' own ShapeMark but also on the independently developed Gaussian Shading baseline. The self-citation to ShapeMark as a base method is not load-bearing, because the same synchronization mechanism is demonstrated with Gaussian Shading, and the core result is an externally falsifiable system-level outcome. Proposition 1's residual bound contains unquantified terms (VAE residual, vector-field defect, cycle error), and the text explicitly defers their practical magnitude to empirical examination. This is a weakness in justification or robustness evidence, but it is not circularity: no equation is reduced by construction to the claim it is supposed to support, and no fitted parameter is renamed a prediction. The score is therefore 0.

Assumptions & free parameters 5 free parameters · 5 assumptions · 1 invented entities

The central claim rests on the empirical smallness of the residual in Eq. (9), on hand-chosen anchor hyperparameters, and on an unspecified rotation attack protocol. These are the burdens the reader must accept without independent evidence.

free parameters (5)
  • Anchor size s=16 (central patch) = 16×16
    Chosen by hand to balance stability vs payload area; not derived.
  • Injection strength λ = 0.2
    Controls anchor-vs-content tradeoff; likely selected via ablation.
  • Angular frequency set K and phase offsets = K={1,3}, φ=(0,0.7)
    Ablation shows full multi-frequency best; values are design choices, not derived.
  • Search grids: 5° coarse, 1° refinement within ±3°, 0.5° local refinement within ±2° = 5°/1°/0.5°
    Hand-set resolution; directly controls angle accuracy/cost.
  • DDIM inversion: 10 steps, null prompt = 10 steps
    Inversion schedule chosen for recovery; affects residual size.
assumptions (5)
  • domain assumption The inversion vector field v_t is locally Lipschitz and the rotation-compatibility defect δ_t is small enough over the relevant trajectory
    Proposition 1's bound depends on finite Lipschitz constants and small δ_t; paper does not measure them, only downstream matching.
  • domain assumption VAE residual r_vae from image rotation is small; encoder approximately commutes with rotation
    Eq. (3) decomposes, but smallness is asserted/validated indirectly; boundary/interpolation effects are absorbed into r_vae but not quantified.
  • domain assumption Reference latent has no nontrivial rotational symmetry, so D_ideal(α,β) is minimized at β=α
    Used in Eq. (12)-(15); random latents make it plausible, not proven.
  • domain assumption The rotation attack preserves the central anchor region (no crop that removes the center and no border handling that destroys the latent)
    The method selects central region because 'centered image rotations preserve central structure'; attack protocol unspecified.
  • standard math Gronwall inequality and Fourier rotation theorem are valid
    Standard tools; accepted.
invented entities (1)
  • Multi-frequency phase anchor (central 16×16 latent patch with harmonics k=1,3)
    purpose: Provides an analytic orientation cue for rotation-angle estimation before payload decoding.
    The anchor is a new construction introduced by the paper; its only evidence is within the paper's own end-to-end experiments, no external/falsifiable handle outside the system.

how reviews work

0 comments
Cite this review

Pith. "Pith review of AnchorMark: Robust Diffusion Watermarking via Latent-Space Rotation Synchrony." pith.science (2026). https://pith.science/paper/JH5WMTPK

@misc{pith2026260727551,
  author       = {Pith},
  title        = {Pith review of: AnchorMark: Robust Diffusion Watermarking via Latent-Space Rotation Synchrony},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JH5WMTPK}},
  note         = {Machine review of arXiv:2607.27551}
}
read the original abstract

Inversion-based watermarking embeds watermark payloads directly into the generative process, avoiding a separate post-hoc image-domain embedding stage while preserving the native visual fidelity of synthesized images. However, existing methods remain vulnerable to compound lossy post-processing, particularly when rotation is involved, as it disrupts the spatial correspondence required for latent-space decoding. To overcome this limitation, we introduce AnchorMark, a training-free, robust inversion-based watermarking. We uncover a latent-space property termed Rotation Synchrony: image-domain rotations and their counterparts in the recovered initial latent share the same angle. Building on this property, AnchorMark embeds a synchronization anchor in the central region of the initial latent, enabling accurate estimation and correction of the rotation angle during extraction. Experiments show that AnchorMark substantially improves bit accuracy under rotation and combined attacks, with limited impact on image quality.

Figures

Figures reproduced from arXiv: 2607.27551 by the authors.

Figure 1
Figure 1. Intuitive comparison of AnchorMark with repre [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Illustration of Rotation Synchrony: the initial latent [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Empirical validation of Rotation Synchrony: latent [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Overall pipeline of AnchorMark. A multi-frequency phase anchor is injected into the initial diffusion latent together [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

49 extracted references · 7 linked inside Pith

  1. [1]

    Bas, P.; Chassery, J.-M.; and Macq, B. 2002. Geometrically invariant watermarking using feature points. IEEE transactions on image Processing, 11(9): 1014--1028

    2002

  2. [2]

    Ci, H.; Yang, P.; Song, Y.; and Shou, M. Z. 2024. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification. In European conference on computer vision, 338--354. Springer

    2024

  3. [3]

    Cohen, T.; and Welling, M. 2016. Group equivariant convolutional networks. In International conference on machine learning, 2990--2999. PMLR

    2016

  4. [4]

    Fang, H.; Chen, K.; Ma, Z.; Deng, J.; Li, Y.; Zhang, W.; and Chang, E.-C. 2025 a . SynTag: Enhancing the Geometric Robustness of Inversion-based Generative Image Watermarking. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 15416--15425

    2025

  5. [5]

    Fang, H.; Chen, K.; Yang, Z.; Cui, B.; Zhang, W.; and Chang, E.-C. 2025 b . CoSDA: Enhancing the Robustness of Inversion-based Generative Image Watermarking Framework. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, 2888--2896

    2025

  6. [6]

    Fernandez, P.; Couairon, G.; J \'e gou, H.; Douze, M.; and Furon, T. 2023. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 22466--22477

    2023

  7. [7]

    Fernandez, P.; Sablayrolles, A.; Furon, T.; J \'e gou, H.; and Douze, M. 2022. Watermarking images in self-supervised latent spaces. In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 3054--3058. IEEE

    2022

  8. [8]

    Gustavosta . 2022. Stable Diffusion Prompts Dataset. https://huggingface.co/datasets/Gustavosta/Stable-Diffusion-Prompts. Accessed: 2026-01-23

    2022

Show all 49 references
  1. [9]

    Heusel, M.; Ramsauer, H.; Unterthiner, T.; Nessler, B.; and Hochreiter, S. 2017. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems, 30

    2017

  2. [10]

    Ho, J.; Jain, A.; and Abbeel, P. 2020. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33: 6840--6851

    2020

  3. [11]

    C.; Miller, M

    Ingemar, J. C.; Miller, M. L.; Jeffrey, A. B.; Fridrich, J.; and Kalker, T. 2008. Digital watermarking and steganography. Elsevier Inc

    2008

  4. [13]

    Lenc, K.; and Vedaldi, A. 2015. Understanding image representations by measuring their equivariance and equivalence. In Proceedings of the IEEE conference on computer vision and pattern recognition, 991--999

    2015

  5. [14]

    Lin, T.-Y.; Maire, M.; Belongie, S.; Hays, J.; Perona, P.; Ramanan, D.; Doll \'a r, P.; and Zitnick, C. L. 2014. Microsoft coco: Common objects in context. In European conference on computer vision, 740--755. Springer

    2014

  6. [16]

    W.; Hallacy, C.; Ramesh, A.; Goh, G.; Agarwal, S.; Sastry, G.; Askell, A.; Mishkin, P.; Clark, J.; et al

    Radford, A.; Kim, J. W.; Hallacy, C.; Ramesh, A.; Goh, G.; Agarwal, S.; Sastry, G.; Askell, A.; Mishkin, P.; Clark, J.; et al. 2021. Learning transferable visual models from natural language supervision. In International conference on machine learning, 8748--8763. PMLR

    2021

  7. [17]

    Rombach, R.; Blattmann, A.; Lorenz, D.; Esser, P.; and Ommer, B. 2022. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 10684--10695

    2022

  8. [20]

    Tancik, M.; Mildenhall, B.; and Ng, R. 2020. Stegastamp: Invisible hyperlinks in physical photographs. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2117--2126

    2020

  9. [22]

    E.; Garbin, S

    Worrall, D. E.; Garbin, S. J.; Turmukhambetov, D.; and Brostow, G. J. 2017. Harmonic networks: Deep translation and rotation equivariance. In Proceedings of the IEEE conference on computer vision and pattern recognition, 5028--5037

    2017

  10. [23]

    Yang, Z.; Zeng, K.; Chen, K.; Fang, H.; Zhang, W.; and Yu, N. 2024. Gaussian shading: Provable performance-lossless image watermarking for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 12162--12171

    2024

  11. [25]

    Zhu, J.; Kaplan, R.; Johnson, J.; and Fei-Fei, L. 2018. Hidden: Hiding data with deep networks. In Proceedings of the European conference on computer vision (ECCV), 657--672

    2018

  12. [26]

    Proceedings of the IEEE conference on computer vision and pattern recognition , pages=

    Understanding image representations by measuring their equivariance and equivalence , author=. Proceedings of the IEEE conference on computer vision and pattern recognition , pages=

  13. [27]

    Proceedings of the IEEE conference on computer vision and pattern recognition , pages=

    Harmonic networks: Deep translation and rotation equivariance , author=. Proceedings of the IEEE conference on computer vision and pattern recognition , pages=

  14. [28]

    International conference on machine learning , pages=

    Group equivariant convolutional networks , author=. International conference on machine learning , pages=. 2016 , organization=

    2016

  15. [29]

    arXiv preprint arXiv:2502.09509 , year=

    Eq-vae: Equivariance regularized latent space for improved generative image modeling , author=. arXiv preprint arXiv:2502.09509 , year=

    arXiv

  16. [30]

    Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

    High-resolution image synthesis with latent diffusion models , author=. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

  17. [31]

    arXiv preprint arXiv:2010.02502 , year=

    Denoising diffusion implicit models , author=. arXiv preprint arXiv:2010.02502 , year=

    2010 arXiv

  18. [32]

    arXiv preprint arXiv:2011.13456 , year=

    Score-based generative modeling through stochastic differential equations , author=. arXiv preprint arXiv:2011.13456 , year=

    2011 arXiv

  19. [33]

    arXiv preprint arXiv:2410.01244 , year=

    Equivariant score-based generative models provably learn distributions with symmetries efficiently , author=. arXiv preprint arXiv:2410.01244 , year=

    arXiv

  20. [34]

    Foundations and trends in computer graphics and vision , volume=

    Image alignment and stitching: A tutorial , author=. Foundations and trends in computer graphics and vision , volume=. 2007 , publisher=

    2007

  21. [35]

    IEEE transactions on pattern analysis and machine intelligence , volume=

    Parametric image alignment using enhanced correlation coefficient maximization , author=. IEEE transactions on pattern analysis and machine intelligence , volume=. 2008 , publisher=

    2008

  22. [36]

    Advances in neural information processing systems , volume=

    Denoising diffusion probabilistic models , author=. Advances in neural information processing systems , volume=

  23. [37]

    Proceedings of the IEEE/CVF International Conference on Computer Vision , pages=

    SynTag: Enhancing the Geometric Robustness of Inversion-based Generative Image Watermarking , author=. Proceedings of the IEEE/CVF International Conference on Computer Vision , pages=

  24. [38]

    2008 , publisher=

    Digital watermarking and steganography , author=. 2008 , publisher=

    2008

  25. [39]

    Proceedings of the European conference on computer vision (ECCV) , pages=

    Hidden: Hiding data with deep networks , author=. Proceedings of the European conference on computer vision (ECCV) , pages=

  26. [40]

    arXiv preprint arXiv:1909.01285 , year=

    Robust invisible video watermarking with attention , author=. arXiv preprint arXiv:1909.01285 , year=

    1909 arXiv

  27. [41]

    Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

    Stegastamp: Invisible hyperlinks in physical photographs , author=. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

  28. [42]

    ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages=

    Watermarking images in self-supervised latent spaces , author=. ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages=. 2022 , organization=

    2022

  29. [43]

    Proceedings of the IEEE/CVF International Conference on Computer Vision , pages=

    The stable signature: Rooting watermarks in latent diffusion models , author=. Proceedings of the IEEE/CVF International Conference on Computer Vision , pages=

  30. [44]

    arXiv preprint arXiv:2305.20030 , year=

    Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust , author=. arXiv preprint arXiv:2305.20030 , year=

    arXiv

  31. [45]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

    Gaussian shading: Provable performance-lossless image watermarking for diffusion models , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

  32. [46]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    CoSDA: Enhancing the Robustness of Inversion-based Generative Image Watermarking Framework , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  33. [47]

    IEEE transactions on image Processing , volume=

    Geometrically invariant watermarking using feature points , author=. IEEE transactions on image Processing , volume=. 2002 , publisher=

    2002

  34. [48]

    European conference on computer vision , pages=

    Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification , author=. European conference on computer vision , pages=. 2024 , organization=

    2024

  35. [49]

    2022 , howpublished =

    Stable Diffusion Prompts Dataset , author =. 2022 , howpublished =

    2022

  36. [50]

    Advances in neural information processing systems , volume=

    Gans trained by a two time-scale update rule converge to a local nash equilibrium , author=. Advances in neural information processing systems , volume=

  37. [51]

    International conference on machine learning , pages=

    Learning transferable visual models from natural language supervision , author=. International conference on machine learning , pages=. 2021 , organization=

    2021

  38. [52]

    European conference on computer vision , pages=

    Microsoft coco: Common objects in context , author=. European conference on computer vision , pages=. 2014 , organization=

    2014

  39. [53]

    arXiv preprint arXiv:2603.09454 , year=

    ShapeMark: Robust and Diversity-Preserving Watermarking for Diffusion Models , author=. arXiv preprint arXiv:2603.09454 , year=

    arXiv

  40. [54]

    IEEE transactions on image processing , volume=

    An FFT-based technique for translation, rotation, and scale-invariant image registration , author=. IEEE transactions on image processing , volume=. 1996 , publisher=

    1996

  41. [55]

    2009 , publisher=

    Digital image processing , author=. 2009 , publisher=

    2009

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.