Pith. sign in

REVIEW 4 major objections 4 minor 47 references

This paper claims that existing dataset watermarking methods for diffusion-model fine-tuning are universal and transmissible but can be completely removed by a proposed degrade-and-restore attack, DeAttack, which erases watermarks without h

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 20:30 UTC pith:JRTT2EJX

load-bearing objection The benchmark work is real and useful, but the DeAttack removal claim is not backed by the supplied table—the promised DeAttack columns are missing and the baselines shown leave DiffusionShield at ~100% detection. the 4 major comments →

arxiv 2511.19316 v2 pith:JRTT2EJX submitted 2025-11-24 cs.CV cs.AI

Evaluating Dataset Watermarking for Fine-tuning Traceability of Customized Diffusion Models: A Comprehensive Benchmark and Removal Approach

Xincheng Wang , Hanchi Sun , Wenjun Sun , Kejun Xue , Wangqiu Zhou , Jianbo Zhang , Wei Sun , Dandan Zhu
show 3 more authors
Xiongkuo Min Jun Jia Zhijun Fang
This is my paper
classification cs.CV cs.AI
keywords dataset watermarkingdiffusion modelfine-tuning traceabilitywatermark removalbenchmarkthreat modelrobustnesscustomized generation
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper argues that current dataset watermarking methods for tracing unauthorized fine-tuning of diffusion models are not ready for real-world adversaries. It builds a unified benchmark testing three properties—universality across fine-tuning methods and tasks, transmissibility when only part of the dataset is watermarked, and robustness to post-processing—and finds the methods pass the first two but fail the third. The paper then introduces DeAttack, a watermark removal method that degrades watermarked images and restores them, claiming it completely eliminates dataset watermarks while leaving fine-tuning performance intact. If true, this means existing protection can be bypassed by a determined user, and watermark designers must treat degradation-restoration as a core threat.

Core claim

The central claim is that dataset watermarking methods for diffusion models, while universal and transmissible, cannot withstand a targeted degradation-restoration removal attack. Under the benchmark, DiffusionShield achieves near-perfect detection across all fine-tuning settings, while SIREN performs near random chance; the other methods sit in between and often collapse when the text encoder is trained. The paper's DeAttack applies degradation (Gaussian noise, blur, JPEG-like compression, latent-space noise) followed by high-quality restoration with pretrained networks, reducing watermark detection accuracy to chance without measurable harm to generation quality. The conclusion is that rob

What carries the argument

The key mechanism is the regeneration attack formulated as x' = R(D(x)), where D degrades the watermarked image to disrupt the embedded watermark and R restores perceptual quality to make the result usable for fine-tuning. DeAttack instantiates this with an autoencoder-based pipeline combining pixel-space and latent-space degradations with restoration networks such as IRNeXt and SwinIR, trained on standard image restoration data. This orchestrated degrade-then-restore loop is what breaks watermarks that survive ordinary noise, blur, or JPEG.

Load-bearing premise

The entire comparison rests on an undisclosed calibration of watermark embedding strength across methods, and on treating each method's own detector and threshold as comparable; if that calibration is arbitrary, the detection-accuracy rankings and the claimed robustness conclusions do not follow.

What would settle it

Re-run the benchmark with DeAttack applied to the watermarked datasets, fine-tune with the same protocols, and measure detection accuracy: if any method (for example, DiffusionShield) keeps accuracy near 100% after removal, or if fine-tuning utility degrades sharply in FID or CLIP-T, the paper's central removal claim fails. Also, if the embedding-strength calibration values are disclosed and re-running with different calibration changes the method rankings, the fairness premise fails.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • If DeAttack works as claimed, dataset watermarking cannot by itself guarantee traceability against a determined adversary who applies degradation and restoration before fine-tuning.
  • Robustness evaluations of watermarking methods should include adversarial removal attacks, not only common image distortions, or they will overstate real-world protection.
  • Among the tested methods, DiffusionShield is the strongest candidate for practical use, while SIREN provides essentially no traceability in these settings.
  • Training the text encoder during fine-tuning weakens several watermarking methods, suggesting text-encoder updates are a natural attack surface.
  • The proposed threat model and three-dimensional benchmark provide a shared protocol for comparing future dataset watermarking methods.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • One extension, not pursued here, is to test watermarking schemes that embed signals in model weights or prompts rather than training images; these may resist degradation-restoration attacks that target pixel-level watermarks.
  • The benchmark's structure suggests that robustness should be measured against an adaptive adversary who knows the watermarking method, since static robustness tests underestimate real-world risk.
  • DeAttack could be repurposed as a data augmentation for training more robust watermarks, turning the removal attack into a defense that forces watermarks to survive degradation and restoration.
  • The paper's finding implies that any practical deployment of dataset watermarking should assume an adversary will apply some form of input purification, and should therefore target semantic or structural features that survive such purification.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes a unified threat model and evaluation framework for dataset watermarking in customized diffusion models, benchmarking four watermarking methods (DIAGNOSIS, DiffusionShield, SIREN, WatermarkDM) across three datasets, four fine-tuning approaches, two text-encoder settings, several watermarked-subset ratios, and three common distortions. It reports that existing methods are largely universal and transmissible, with DiffusionShield the most robust and SIREN near chance. Based on this evaluation, the paper introduces DeAttack, a degradation-restoration removal framework claimed to 'completely remove dataset watermarks without affecting fine-tuning.' The benchmark portion is substantial, but the removal claim is not supported by the evidence actually presented in Table 5, which contains no DeAttack-specific columns and shows DiffusionShield retaining near-perfect detection accuracy under all six listed restoration baselines.

Significance. If the benchmark is taken at face value, it provides a useful comparison resource: it covers four open-source watermarking methods, multiple fine-tuning paradigms, three datasets, and a range of practical distortions, with FID, CLIP-T, and detection accuracy reported. Using each method's own watermark decoder is appropriate for a traceability test, so the 'circularity' concern is not the main issue. However, the paper's stated novel contribution—DeAttack—is not substantiated: the table that is supposed to validate it appears to report only off-the-shelf restoration baselines, and the visible numbers directly contradict the abstract's 'completely remove' claim. The calibration of watermark embedding strength is also undisclosed, which threatens the fairness of cross-method comparisons. The benchmark has real value, but the removal contribution needs substantial rework or repositioning.

major comments (4)
  1. [Table 5 and Section 5] The caption of Table 5 states that 'the last nine gray-shaded columns correspond to our methods,' but the rendered table contains only six columns—Bmshj2018, Cheng et al., Diffusion, SwinIR (Denoise), SwinIR (JPEG AR), and IRNeXt (Deblur)—none of which is identified as DeAttack. Section 5 then claims that 'our IRNeXt-based DeAttack achieves stronger watermark removal ... as validated in Table 5,' but no DeAttack column exists to validate this. Moreover, the six columns that are shown directly contradict the abstract's 'completely remove' assertion: DiffusionShield detection accuracy remains 98.39–100.00%, and WatermarkDM remains 48.44–62.50%. On the evidence presented, at least one method is not removed by any of the listed degradation-restoration pipelines. The authors must either supply the actual DeAttack results (including the proposed degradation-restoration composition and ablation
  2. [Section 4.2, Universality Evaluation] The statement 'we calibrate the watermark embedding strength across all methods' is load-bearing for every ranking in Tables 2–5, but no calibration procedure, objective, target utility range, or per-method embedding strengths are reported. Since detection accuracy is monotone in embedding strength for most watermarking schemes, an arbitrary or method-specific calibration could determine the observed ranking (e.g., DiffusionShield near 100% vs. SIREN near 50%). Without this information, the fairness of the benchmark and the robustness conclusions do not follow. Please disclose the calibration protocol, the actual strength values, and the resulting FID/CLIP-T ranges.
  3. [Section 5, Eqs. (2)–(14)] DeAttack is described as a 'unified framework' and an optimization in Eq. (2), but the implementation described in the text is simply the composition of pretrained restoration models: IRNeXt trained on DIV2K/Flickr2K/WED and two pretrained SwinIR models. There is no description of how Eq. (2) is solved, what the learnable degradation prior P_θ in Eq. (13) is, or how the proposed autoencoder in Figure 4 is trained or adapted. If DeAttack is just an application of existing restoration networks, then the claim of a new removal method is overstated, and the benchmark in Table 5 is not an evaluation of DeAttack at all. Please clarify the novelty and provide a concrete algorithmic description.
  4. [Tables 4 and 5, detection metric] All detection accuracy numbers are obtained with each method's original detector and threshold. After degradation and restoration, the distribution of generated images changes substantially, and a fixed threshold may no longer be statistically calibrated. The paper should at least report ROC curves or detection scores at a fixed false-positive rate, rather than only accuracy at a threshold that may not correspond to comparable operating points across methods. This is secondary to the missing DeAttack results, but it affects the robustness comparison as well.
minor comments (4)
  1. [Section 4.3] The text says 'Compared to the results obtained when fine-tuning with fully watermarked images in Table 3,' but Table 3 reports mixed-ratio results; the fully watermarked results are in Table 2. Please correct the cross-reference.
  2. [Section 5, Eq. (2)] The operator E(·) in Eq. (2) is referred to as 'a watermark extractor or spectral energy operator,' but no concrete definition, implementation, or choice of λ is given. This makes the proposed optimization untestable as stated.
  3. [Figure 3] The caption says the figure indicates 'the optimal FID score and CLIP-T similarity for each fine-tuning approach,' but it is unclear what 'optimal' means here and how the figure should be read. A legend or explanation of the displayed samples would help.
  4. [Table 5] The table header labels the columns 'Results of different DeAttack methods,' but the columns are named after well-known baseline restorers. Even if the authors intended these as DeAttack variants, the naming is misleading and should be clarified.

Circularity Check

0 steps flagged

No circular derivation: benchmark uses each method's own decoder, the removal analysis is standard signal processing, and the undisclosed strength calibration is a transparency issue rather than a self-referential step.

full rationale

The paper's evaluation chain is not circular. For the benchmark (Section 4), each watermarking method is tested with its own open-source detector and original settings; measuring traceability with the method's own decoder is the correct protocol, not a tautology. The Section 5 removal analysis is a constructive attack based on textbook Fourier-domain arguments (Eqs. 3-8) and a generic degradation-restoration composition x'=R(D(x)); it does not assume the conclusion that watermarks are removable. The claimed 'complete removal' is poorly supported by Table 5, which shows DiffusionShield accuracy near 100% under the listed restorers and whose caption says 'The last nine gray-shaded columns correspond to our methods' without rendering those DeAttack-specific results; this is an evidence gap, not circularity. Section 4.2's undisclosed calibration of watermark embedding strength to equalize FID/CLIP-T is load-bearing for the fairness of cross-method accuracy comparisons, but since no equation ties the reported Acc to the calibrated parameter, it is a reproducibility/transparency weakness rather than a reduction of the result to its inputs. No load-bearing self-citation or imported uniqueness theorem appears; prior work is cited as external method sources. Overall, the derivation is self-contained and the central circularity score is 0.

Axiom & Free-Parameter Ledger

1 free parameters · 5 axioms · 1 invented entities

The benchmark rests on the domain premise that training-image watermarks survive fine-tuning and are readable by original decoders, and on an unreported embedding-strength calibration. No new mathematical entities are introduced; the removal attack is a pipeline over pretrained restoration networks. The core empirical claims therefore depend on a handful of experimental choices rather than on derived constants.

free parameters (1)
  • watermark embedding strength per method = not reported
    Section 4.2 calibrates embedding strength across methods to equalize FID/CLIP before comparing detection accuracy. No values or procedure are given, yet all method rankings depend on this choice.
axioms (5)
  • domain assumption Watermark signals embedded in training images survive fine-tuning and remain detectable in generated outputs by the original decoder.
    This is the foundational premise of the threat model in Section 3.1; if fine-tuning destroys or shifts the watermark signal, the entire benchmark is meaningless.
  • domain assumption Detection accuracy measured with each method's fixed detector and threshold is a valid, comparable measure of traceability across methods and attacks.
    Section 4.1 defines Acc as the metric. No threshold re-calibration is described; under distortions or removal, optimal thresholds may shift, so raw accuracy comparisons may mislead.
  • standard math Gaussian noise, Gaussian blur, and JPEG compression are adequately modeled by the linear Fourier-domain equations (3)-(8).
    The frequency-domain analysis is standard for Gaussian operations, but JPEG compression is nonlinear in practice; JPEG results are therefore empirical rather than derived.
  • domain assumption Pretrained restoration models (IRNeXt on DIV2K/Flickr2K/WED, SwinIR for denoising and JPEG correction) remove dataset watermarks from training images while preserving fine-tuning utility.
    The DeAttack pipeline in Section 5 relies on transfer from generic image restoration. No evidence is provided that generic restoration removes imperceptible watermarks better than targeted attacks or that it never degrades fine-tuning.
  • ad hoc to paper A unified watermark-removal attack can be expressed as x' = R(D(x)) with degradation D and restoration R, where the optimal R is a generic restoration network rather than an attack-specific trained model.
    Equations (12)-(14) posit this general framework, but the implemented DeAttack uses existing IRNeXt and SwinIR models and no learnable degradation prior P_theta, so the general formulation is not actually exercised.
invented entities (1)
  • None no independent evidence
    purpose: No new physical or conceptual entities are introduced.
    DeAttack is a pipeline of existing models, not a new particle, force, dimension, or ledger entry. The 'learnable degradation prior P_theta' appears in the formulation but is not implemented, so it is a formatting device rather than a substantive entity.

pith-pipeline@v1.3.0-alltime-deepseek · 14384 in / 12621 out tokens · 130416 ms · 2026-08-03T20:30:31.303807+00:00 · methodology

0 comments
Cite this review

Pith. "Pith review of Evaluating Dataset Watermarking for Fine-tuning Traceability of Customized Diffusion Models: A Comprehensive Benchmark and Removal Approach." pith.science (2026). https://pith.science/paper/JRTT2EJX

@misc{pith2026251119316,
  author       = {Pith},
  title        = {Pith review of: Evaluating Dataset Watermarking for Fine-tuning Traceability of Customized Diffusion Models: A Comprehensive Benchmark and Removal Approach},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JRTT2EJX}},
  note         = {Machine review of arXiv:2511.19316}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Recent fine-tuning techniques for diffusion models enable them to reproduce specific image sets, such as particular faces or artistic styles, but also introduce copyright and security risks. Dataset watermarking has been proposed to ensure traceability by embedding imperceptible watermarks into training images, which remain detectable in outputs even after fine-tuning. However, current methods lack a unified evaluation framework. To address this, this paper establishes a general threat model and introduces a comprehensive evaluation framework encompassing Universality, Transmissibility, and Robustness. Experiments show that existing methods perform well in universality and transmissibility, and exhibit some robustness against common image processing operations, yet still fall short under real-world threat scenarios. To reveal these vulnerabilities, the paper further proposes a practical watermark removal method that fully eliminates dataset watermarks without affecting fine-tuning, highlighting a key challenge for future research.

Figures

Figures reproduced from arXiv: 2511.19316 by Dandan Zhu, Hanchi Sun, Jianbo Zhang, Jun Jia, Kejun Xue, Wangqiu Zhou, Wei Sun, Wenjun Sun, Xincheng Wang, Xiongkuo Min, Zhijun Fang.

Figure 1
Figure 1. Figure 1: Visualization results of the four fine-tuning methods on three datasets. The first column shows the result without training the [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Overview of the threat model. Image Owners embed binary watermarks into datasets to establish ownership and ensure trace￾ability. Upon acquiring the data, Image Users may generate customized images using various fine-tuning or model adaptation techniques. If the original watermark is successfully detected in the generated images, the protection mechanism is deemed effective; otherwise, it is considered to … view at source ↗
Figure 3
Figure 3. Figure 3: The visualization of generation results after applying natural distortion. The figure indicates the optimal [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: The architecture of DeAttack. A unified framework for watermark removal, utilizing image degradation and restoration processes [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

47 extracted references · 3 linked inside Pith

  1. [1]

    Ntire 2017 challenge on single image super-resolution: Dataset and study

    Eirikur Agustsson and Radu Timofte. Ntire 2017 challenge on single image super-resolution: Dataset and study. InPro- ceedings of the IEEE conference on computer vision and pat- tern recognition workshops, pages 126–135, 2017. 8

    2017

  2. [2]

    Variational image compres- sion with a scale hyperprior

    Johannes Ball ´e, David Minnen, Saurabh Singh, Sung Jin Hwang, and Nick Johnston. Variational image compres- sion with a scale hyperprior. InInternational Conference on Learning Representations, 2018. 8

    2018

  3. [3]

    Cold diffusion: Inverting arbitrary im- age transforms without noise.Advances in Neural Informa- tion Processing Systems, 36:41259–41282, 2023

    Arpit Bansal, Eitan Borgnia, Hong-Min Chu, Jie Li, Hamid Kazemi, Furong Huang, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Cold diffusion: Inverting arbitrary im- age transforms without noise.Advances in Neural Informa- tion Processing Systems, 36:41259–41282, 2023. 5

    2023

  4. [4]

    Trustmark: Robust watermarking and watermark removal for arbitrary resolution images

    Tu Bui, Shruti Agarwal, and John Collomosse. Trustmark: Robust watermarking and watermark removal for arbitrary resolution images. InProceedings of the IEEE/CVF Interna- tional Conference on Computer Vision, pages 18629–18639,

  5. [5]

    Learned image compression with discretized gaussian mixture likelihoods and attention modules

    Zhengxue Cheng, Heming Sun, Masaru Takeuchi, and Jiro Katto. Learned image compression with discretized gaussian mixture likelihoods and attention modules. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 7939–7948, 2020. 8

    2020

  6. [6]

    Digital watermarking.Journal of Electronic Imaging, 11(3):414–414, 2002

    Ingemar Cox, Matthew Miller, Jeffrey Bloom, and Chris Honsinger. Digital watermarking.Journal of Electronic Imaging, 11(3):414–414, 2002. 2

    2002

  7. [7]

    Irnext: rethinking convolutional network design for image restoration

    Yuning Cui, Wenqi Ren, Sining Yang, Xiaochun Cao, and Alois Knoll. Irnext: rethinking convolutional network design for image restoration. InProceedings of the 40th Interna- tional Conference on Machine Learning, pages 6545–6564,

  8. [8]

    Revitalizing convolutional network for image restoration

    Yuning Cui, Wenqi Ren, Xiaochun Cao, and Alois Knoll. Revitalizing convolutional network for image restoration. IEEE Transactions on Pattern Analysis and Machine Intel- ligence, 46(12):9423–9438, 2024. 8

    2024

  9. [9]

    Ft-shield: A watermark against unauthorized fine-tuning in text-to-image diffusion models.ACM SIGKDD Explorations Newsletter, 26(2):76–88, 2025

    Yingqian Cui, Jie Ren, Yuping Lin, Han Xu, Pengfei He, Yue Xing, Lingjuan Lyu, Wenqi Fan, Hui Liu, and Jiliang Tang. Ft-shield: A watermark against unauthorized fine-tuning in text-to-image diffusion models.ACM SIGKDD Explorations Newsletter, 26(2):76–88, 2025. 2

    2025

  10. [10]

    Diffusionshield: A water- mark for data copyright protection against generative diffu- sion models.ACM SIGKDD Explorations Newsletter, 26(2): 60–75, 2025

    Yingqian Cui, Jie Ren, Han Xu, Pengfei He, Hui Liu, Lichao Sun, Yue Xing, and Jiliang Tang. Diffusionshield: A water- mark for data copyright protection against generative diffu- sion models.ACM SIGKDD Explorations Newsletter, 26(2): 60–75, 2025. 2, 4

    2025

  11. [11]

    Freecustom: Tuning- free customized image generation for multi-concept compo- sition

    Ganggui Ding, Canyu Zhao, Wen Wang, Zhen Yang, Zide Liu, Hao Chen, and Chunhua Shen. Freecustom: Tuning- free customized image generation for multi-concept compo- sition. InProceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition, pages 9089–9098,

  12. [12]

    Are diffusion models vulnerable to membership inference attacks? InInternational Conference on Machine Learning, pages 8717–8730

    Jinhao Duan, Fei Kong, Shiqi Wang, Xiaoshuang Shi, and Kaidi Xu. Are diffusion models vulnerable to membership inference attacks? InInternational Conference on Machine Learning, pages 8717–8730. PMLR, 2023. 1

    2023

  13. [13]

    Cdi: Copyrighted data identification in dif- fusion models

    Jan Dubi ´nski, Antoni Kowalczuk, Franziska Boenisch, and Adam Dziedzic. Cdi: Copyrighted data identification in dif- fusion models. InProceedings of the Computer Vision and Pattern Recognition Conference, pages 18674–18684, 2025. 1

    2025

  14. [14]

    The stable signature: Rooting watermarks in latent diffusion models

    Pierre Fernandez, Guillaume Couairon, Herv ´e J ´egou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. InProceed- ings of the IEEE/CVF International Conference on Com- puter Vision, pages 22466–22477, 2023. 1

    2023

  15. [15]

    An image is worth one word: Personalizing text-to- image generation using textual inversion.arXiv preprint arXiv:2208.01618, 2022

    Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patash- nik, Amit H Bermano, Gal Chechik, and Daniel Cohen- Or. An image is worth one word: Personalizing text-to- image generation using textual inversion.arXiv preprint arXiv:2208.01618, 2022. 2

    Pith/arXiv arXiv 2022

  16. [16]

    Svdiff: Compact param- eter space for diffusion fine-tuning

    Ligong Han, Yinxiao Li, Han Zhang, Peyman Milanfar, Dimitris Metaxas, and Feng Yang. Svdiff: Compact param- eter space for diffusion fine-tuning. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 7323–7334, 2023. 2

    2023

  17. [17]

    Gans trained by a two time-scale update rule converge to a local nash equilib- rium.Advances in neural information processing systems, 30, 2017

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilib- rium.Advances in neural information processing systems, 30, 2017. 4

    2017

  18. [18]

    Lora: Low-rank adaptation of large language models.ICLR, 1(2):3, 2022

    Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen- Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et al. Lora: Low-rank adaptation of large language models.ICLR, 1(2):3, 2022. 2

    2022

  19. [19]

    Ashwani Kumar. A review on implementation of digital image watermarking techniques using lsb and dwt.Infor- mation and Communication Technology for Sustainable De- velopment: Proceedings of ICT4SD 2018, pages 595–602,

    2018

  20. [20]

    Multi-concept customization of text-to-image diffusion

    Nupur Kumari, Bingliang Zhang, Richard Zhang, Eli Shechtman, and Jun-Yan Zhu. Multi-concept customization of text-to-image diffusion. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 1931–1941, 2023. 2

    1931

  21. [21]

    Towards reli- able verification of unauthorized data usage in personalized text-to-image diffusion models

    Boheng Li, Yanhao Wei, Yankai Fu, Zhenting Wang, Yiming Li, Jie Zhang, Run Wang, and Tianwei Zhang. Towards reli- able verification of unauthorized data usage in personalized text-to-image diffusion models. In2025 IEEE Symposium on Security and Privacy (SP), pages 2564–2582. IEEE, 2025. 2, 4

    2025

  22. [22]

    Swinir: Image restoration us- ing swin transformer

    Jingyun Liang, Jiezhang Cao, Guolei Sun, Kai Zhang, Luc Van Gool, and Radu Timofte. Swinir: Image restoration us- ing swin transformer. InProceedings of the IEEE/CVF inter- national conference on computer vision, pages 1833–1844,

  23. [23]

    Deep learning face attributes in the wild

    Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. InProceedings of the IEEE international conference on computer vision, pages 3730–3738, 2015. 4

    2015

  24. [24]

    Waterloo ex- 9 ploration database: New challenges for image quality assess- ment models.IEEE Transactions on Image Processing, 26 (2):1004–1016, 2016

    Kede Ma, Zhengfang Duanmu, Qingbo Wu, Zhou Wang, Hongwei Yong, Hongliang Li, and Lei Zhang. Waterloo ex- 9 ploration database: New challenges for image quality assess- ment models.IEEE Transactions on Image Processing, 26 (2):1004–1016, 2016. 8

    2016

  25. [25]

    Generative watermarking against unauthorized subject-driven image synthesis.arXiv preprint arXiv:2306.07754, 2023

    Yihan Ma, Zhengyu Zhao, Xinlei He, Zheng Li, Michael Backes, and Yang Zhang. Generative watermarking against unauthorized subject-driven image synthesis.arXiv preprint arXiv:2306.07754, 2023. 1

    Pith/arXiv arXiv 2023

  26. [26]

    Dwt-dct-svd based watermark- ing

    KA Navas, Mathews Cheriyan Ajay, M Lekshmi, Tampy S Archana, and M Sasikumar. Dwt-dct-svd based watermark- ing. In2008 3rd international conference on communication systems software and middleware and workshops (COM- SWARE’08), pages 271–274. IEEE, 2008. 2

    2008

  27. [27]

    Justin N. M. Pinkney. Pokemon blip captions.https: / / huggingface . co / datasets / lambdalabs / pokemon-blip-captions/, 2022. 4

    2022

  28. [28]

    Entruth: Enhanc- ing the traceability of unauthorized dataset usage in text-to- image diffusion models with minimal and robust alterations

    Jie Ren, Yingqian Cui, Chen Chen, Vikash Sehwag, Yue Xing, Jiliang Tang, and Lingjuan Lyu. Entruth: Enhanc- ing the traceability of unauthorized dataset usage in text-to- image diffusion models with minimal and robust alterations. arXiv preprint arXiv:2406.13933, 2024. 1

    arXiv 2024

  29. [29]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High-resolution image synthesis with latent diffusion models. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022. 4

    2022

  30. [30]

    Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation

    Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 22500– 22510, 2023. 2

    2023

  31. [31]

    Combinational image wa- termarking in the spatial and frequency domains.Pattern Recognition, 36(4):969–975, 2003

    Frank Y Shih and Scott YT Wu. Combinational image wa- termarking in the spatial and frequency domains.Pattern Recognition, 36(4):969–975, 2003. 2

    2003

  32. [32]

    Deep unsupervised learning using nonequilibrium thermodynamics

    Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. InInternational confer- ence on machine learning, pages 2256–2265. pmlr, 2015. 1

    2015

  33. [33]

    Improved techniques for training score-based generative models.Advances in neural information processing systems, 33:12438–12448, 2020

    Yang Song and Stefano Ermon. Improved techniques for training score-based generative models.Advances in neural information processing systems, 33:12438–12448, 2020. 1

    2020

  34. [34]

    Denet: Disen- tangled embedding network for visible watermark removal

    Ruizhou Sun, Yukun Su, and Qingyao Wu. Denet: Disen- tangled embedding network for visible watermark removal. InProceedings of the AAAI Conference on Artificial Intelli- gence, pages 2411–2419, 2023. 5

    2023

  35. [35]

    Stegastamp: Invisible hyperlinks in physical photographs

    Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical photographs. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2117–2126, 2020. 2

    2020

  36. [36]

    Ex- ploring clip for assessing the look and feel of images

    Jianyi Wang, Kelvin CK Chan, and Chen Change Loy. Ex- ploring clip for assessing the look and feel of images. InPro- ceedings of the AAAI conference on artificial intelligence, pages 2555–2563, 2023. 4

    2023

  37. [37]

    Diagnosis: Detecting unau- thorized data usages in text-to-image diffusion models

    Zhenting Wang, Chen Chen, Lingjuan Lyu, Dimitris N Metaxas, and Shiqing Ma. Diagnosis: Detecting unau- thorized data usages in text-to-image diffusion models. In 12th International Conference on Learning Representations, ICLR 2024, 2024. 2, 4

    2024

  38. [38]

    Powerful and flexible: Personalized text- to-image generation via reinforcement learning

    Fanyue Wei, Wei Zeng, Zhenyang Li, Dawei Yin, Lixin Duan, and Wen Li. Powerful and flexible: Personalized text- to-image generation via reinforcement learning. InEuropean Conference on Computer Vision, pages 394–410. Springer,

  39. [39]

    Tree-rings watermarks: Invisible fingerprints for diffusion images.Advances in Neural Information Process- ing Systems, 36:58047–58063, 2023

    Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings watermarks: Invisible fingerprints for diffusion images.Advances in Neural Information Process- ing Systems, 36:58047–58063, 2023. 1

    2023

  40. [40]

    High- capacity convolutional video steganography with temporal residual modeling

    Xinyu Weng, Yongzhi Li, Lu Chi, and Yadong Mu. High- capacity convolutional video steganography with temporal residual modeling. InProceedings of the 2019 on inter- national conference on multimedia retrieval, pages 87–95,

    2019

  41. [41]

    Wikiart: Visual art encyclopedia.https://www

    Wikiart. Wikiart: Visual art encyclopedia.https://www. wikiart.org/, 2016. 4

    2016

  42. [42]

    Artificial fingerprinting for generative models: Root- ing deepfake attribution in training data

    Ning Yu, Vladislav Skripniuk, Sahar Abdelnabi, and Mario Fritz. Artificial fingerprinting for generative models: Root- ing deepfake attribution in training data. InProceedings of the IEEE/CVF International conference on computer vision, pages 14448–14457, 2021. 2

    2021

  43. [43]

    Invisible steganog- raphy via generative adversarial networks.Multimedia tools and applications, 78(7):8559–8575, 2019

    Ru Zhang, Shiqi Dong, and Jianyi Liu. Invisible steganog- raphy via generative adversarial networks.Multimedia tools and applications, 78(7):8559–8575, 2019. 2

    2019

  44. [44]

    Invisible image watermarks are provably removable using generative ai.Advances in neural information processing systems, 37:8643–8672, 2024

    Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu- Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative ai.Advances in neural information processing systems, 37:8643–8672, 2024. 8

    2024

  45. [45]

    A recipe for watermarking dif- fusion models.arXiv preprint arXiv:2303.10137, 2023

    Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Ngai- Man Cheung, and Min Lin. A recipe for watermarking dif- fusion models.arXiv preprint arXiv:2303.10137, 2023. 2, 4

    Pith/arXiv arXiv 2023

  46. [46]

    Hidden: Hiding data with deep networks

    Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. InProceedings of the European conference on computer vision (ECCV), pages 657–672, 2018. 2

    2018

  47. [47]

    Watermark-embedded adversarial examples for copyright protection against diffusion models

    Peifei Zhu, Tsubasa Takahashi, and Hirokatsu Kataoka. Watermark-embedded adversarial examples for copyright protection against diffusion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24420–24430, 2024. 1, 2 10

    2024