Pith. sign in

REVIEW 3 major objections 5 minor 9 cited by

SoK: Watermarking for AI-Generated Content

T0 review · 3 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper sets out to give the field of watermarking for AI-generated content a single formal vocabulary—definitions of quality, false positive rate, robustness, unforgeability, and message support—and to map how representative schemes…

desk verdict A valuable, well-organized SoK that will be the standard reference for GenAI watermarking definitions, though its comprehensiveness claim rests on an unlisted, non-reproducible paper selection. read the letter →

arxiv 2411.18479 v3 pith:NYBHYQVA submitted 2024-11-27 cs.CR cs.AIcs.LG

Xuandong Zhao , Sam Gunn , Miranda Christ , Jaiden Fairoze , Andres Fabrega , Nicholas Carlini , Sanjam Garg , Sanghyun Hong
show 6 more authors
Milad Nasr Florian Tramer Somesh Jha Lei Li Yu-Xiang Wang Dawn Song
This is my paper · ORCID
classification cs.CRcs.AIcs.LG
keywords watermarkingAI-generatedcontentdetectiontextimageaudioandvideoundetectabilityunforgeability
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Watermarking embeds a hidden signal in AI-generated content so it can later be identified as machine-made. The paper argues that this is the most reliable route to distinguishing AI from human output, because passive detectors rely on statistical quirks that keep failing as models improve. Its central contribution is a formal framework: it defines a watermarking scheme by its generation, detection, decoding, and attribution algorithms, and it pins down six desired properties. It then uses that framework to survey over 100 papers across text, image, audio, and video, comparing representative schemes on quality, false positive rate, robustness, unforgeability, message support, and efficiency. If the framework holds, researchers and policymakers get a common language for what a watermark can and cannot guarantee.

What carries the argument

The central machinery is the formal syntax of a watermark: a generation algorithm keyed by $gk$ that maps a prompt (and optional message) to a response, together with detection, decoding, and attribution algorithms with possibly separate keys. The load-bearing definitions are distortion and distortion-freeness ($\max_{m,\pi} \frac{1}{2} \sum_{x\in R} |\Pr[M(\pi)\to x]-\Pr[\mathrm{Watermark}^M_{gk}(m,\pi)\to x]|$), undetectability, false positive rate, robustness with respect to a channel, and unforgeability. These definitions do the work of turning a scattered literature into a single comparison table, since every scheme can be rated on the same axes.

What would settle it

A systematic literature search could collect all watermarking papers for generative models and check whether every scheme maps onto one of the six defined properties; a scheme that is deployed and works but satisfies none of the definitions, or a quantitative benchmark that reverses a rating in the paper's comparison table, would show the formalization is not field-wide.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that the many ad-hoc watermarking proposals can be understood as instances of a single design space with six formal axes. The paper formalizes quality from weakest to strongest: empirical validation, low distortion, distortion-freeness where the distribution of a single watermarked response matches the unwatermarked model, and undetectability, where even adaptive queries cannot tell the watermarked model apart. It defines false positive rate against content produced independently of the key, robustness against a channel that transforms content, and unforgeability, which requires an attacker to have the embedding key to create falsely attributed content. It separates detection from attribution because the two need different guarantees: detection should be robust, attribution should be unforgeable. It also notes that text watermarks can only embed a few bits, while images and audio can carry messages, and that undetectability is impossible statistically, only computationally. The paper's contribution is this ordering and separation, not a new watermark construction.

Load-bearing premise

The load-bearing premise is that the informally chosen set of over 100 papers is representative enough that the taxonomy and comparison generalize to the whole field; the paper gives no reproducible search protocol, inclusion rules, or corpus list.

Editorial extensions

If this is right

  • If the framework is accepted, future watermarking papers can state precisely which properties they satisfy, and reviewers can ask whether a missing property matters for the stated deployment scenario.
  • Policymakers get a checklist: laws that mandate watermarking should specify whether they require detection, attribution, message embedding, or unforgeable public attribution, because these are different capabilities.
  • The separation of detection and attribution means a single generation algorithm can support both robust spam filtering and unforgeable accountability, without one property destroying the other.
  • The entropy caveat implies that watermarking cannot be a universal detector: near-deterministic outputs cannot carry a watermark, so regulations expecting all AI output to be marked will hit a technical limit.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural next step, not taken in the paper, is to turn the qualitative comparison table into a reproducible benchmark by running standard attack suites on each representative scheme and reporting the numbers.
  • The paper's warning that undetectable watermarks can be used to track individuals suggests that privacy regulation should govern who may embed and who may read watermarks; the paper flags the risk but does not develop the policy consequence.
  • If proof-of-generation becomes feasible, watermark keys will likely need public commitments, so that a model owner cannot retroactively pick a key that makes arbitrary content appear watermarked.
  • The taxonomy implies that 'watermark' is not one technology: text, image, audio, and video schemes have different entropy headroom, so deployment standards should be modality-specific rather than uniform.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This SoK surveys watermarking for AI-generated content across text, image, audio, and video. It motivates watermarking via limitations of post-hoc detection and recent regulatory developments, then formalizes six desired properties (quality, false positive rate, robustness, unforgeability, message support, computational efficiency), describes threat models and evaluation practices, and reviews representative schemes in each modality. The paper closes with open problems such as robust unforgeable public attribution, proof-of-generation, semantic watermarks, and watermarkability of open-source models.

Significance. If the survey's coverage is representative, this is a valuable shared reference: it provides a coherent vocabulary for six watermark properties, connects formal definitions to concrete schemes, and discusses policy in a way that is directly useful to researchers and policymakers. Strengths include the explicit syntax for Detect/Decode/Attribute, the clear separation of robustness and unforgeability, the breadth of the bibliography, and the honest discussion of open problems and potential privacy abuses. The main risk is not internal logic but scope evidence: the selection of surveyed works is not reproducible, and several core definitions come from the authors' own prior work, so the 'comprehensive overview' claim needs stronger support before the taxonomy and Table 1 can be treated as field-level organizing principles.

major comments (3)
  1. [Section 1.1] The methodology states that 'over 100 peer-reviewed papers' were reviewed with qualitative selection criteria, but no search protocol, inclusion/exclusion rules, or list of surveyed papers is provided; the claim of a comprehensive overview is therefore not empirically checkable. Please add a supplementary list of all reviewed papers (e.g., an appendix table) with venue, year, modality, and the reason for inclusion/exclusion, and state the databases and search dates used.
  2. [Section 3.1.3] The sentence 'It also implies that it is impossible to learn detection, decoding, or attribution keys' is too strong as stated. Section 3.4 discusses unforgeable public attribution, where the attribution key is public by design, so such keys are trivially 'learnable' even in an undetectable scheme. Please qualify the claim (e.g., 'without access to the generation key and unless the scheme intentionally publishes the key') or define a precise notion of 'learning keys' from oracle access.
  3. [Table 1] In the manuscript as provided, Table 1 shows the method names and column headers but no rating markers in the cells, so the 'qualitative comparison' described in Section 6 cannot be inspected. Please ensure the table is rendered with the intended darker/lighter circles and add a note on how the ratings were assigned (e.g., from the cited papers' own claims or from independent evaluation).
minor comments (5)
  1. [Section 3.1.2] The statement that 'Computational distortion-freeness is generally no weaker than statistical distortion-freeness in practice' is confusing, since computational distortion-freeness is the weaker notion; I suggest saying it is no stronger.
  2. [Section 4] The threat-model taxonomy is useful, but a table or diagram summarizing adversary capabilities (oracle access, key knowledge, verifier feedback) alongside examples would help readers map attacks to threat models.
  3. [Section 6.2] In the Gaussian Shading discussion, the text says the proof does not account for correlations across multiple images; please clarify that this is a gap between the proved single-response property and the multi-response quality metrics (FID, CLIP score, etc.), not a flaw in the proof itself.
  4. [References] Reference [45] cites 'Exec. Order No. 1411' but the order discussed in the text is Executive Order 14110; the reference list entry should be corrected.
  5. [Table 1] The table row 'Pseudorandom Codes [73]' refers to a text watermark, while Section 6.2 describes the PRC watermark [30] for images; please make the table entries consistent with the text labels.

Circularity Check

0 steps flagged · score 2.0 of 10

No definitional circularity: the SoK organizes and cites prior work rather than deriving a prediction from a fit. The score reflects minor self-citation in the definitions and representative-scheme selection, plus a non-reproducible literature-selection step, none of which is a circular reduction.

full rationale

This paper is a systematization-of-knowledge survey, not a derivation chain, so the fitted-input-called-prediction and self-definitional patterns do not apply. The central deliverable is a taxonomy, formal definitions, and a qualitative comparison, and the paper does not claim to prove a new watermarking construction. The formal definitions in Section 3 are explicitly attributed to prior work, including Definition 3.2 to [68], Definition 3.3 to [28], and Definition 3.6 to [75]. Some of those references share authors with the present paper, but importing and restating definitions is transparent survey practice, not an equation-level reduction. Section 1.1 says the review covered over 100 peer-reviewed papers with selection criteria based on relevance to GenAI watermarking across various modalities, contribution to definitions, threat modeling, evaluation, or technical advances, but no reproducible search protocol or inclusion list is given. This is a scope and representativeness limitation, not circularity. Similarly, Section 6 and Table 1 over-represent the authors' own constructions, including Undetectable WM [28], Pseudorandom Codes [73], PRC Watermark [30], and unforgeable attribution [75], but this is a selection imbalance rather than a case of a parameter fitted to data and then renamed as a prediction. No quoted equation is shown to be equivalent to another by construction, and no cited theorem is used to forbid alternatives in a way that reduces the survey's organizational claims to the authors' prior work alone. Section 7 openly lists unresolved problems, further confirming that the paper is not presenting a forced derivation. The score is therefore 2, reflecting minor non-load-bearing self-citation and an unverified selection step, rather than genuine circularity.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

No new physical or mathematical entities are introduced. The paper's formal objects, watermark generation, detect, decode, and attribute algorithms, are standard abstractions from the cited literature.

assumptions (3)
  • domain assumption The property taxonomy in Section 3, quality, false positive rate, robustness, unforgeability, message support, and efficiency, is the appropriate set of axes for comparing GenAI watermarks.
    Section 3 states these are 'the most important' properties, but no completeness argument is given; the comparison in Table 1 depends on this choice.
  • standard math The cited impossibility and construction theorems are correct, including the impossibility of statistical undetectability [28] and the channel-dependence of robustness.
    Section 3.1.3 and Section 3.3 invoke these theorems to justify presenting only computational undetectability and a channel-relative robustness definition.
  • domain assumption The evaluation metrics listed in Section 5 (AUROC, fixed-FPR detection, PPL, MAUVE, FID, SSIM, and others) are valid proxies for the properties defined in Section 3.
    Section 5 recommends these metrics as standard practice without validating their construct validity for every modality.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SoK: Watermarking for AI-Generated Content." pith.science (2026). https://pith.science/paper/NYBHYQVA

@misc{pith2026241118479,
  author       = {Pith},
  title        = {Pith review of: SoK: Watermarking for AI-Generated Content},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NYBHYQVA}},
  note         = {Machine review of arXiv:2411.18479}
}
read the original abstract

As the outputs of generative AI (GenAI) techniques improve in quality, it becomes increasingly challenging to distinguish them from human-created content. Watermarking schemes are a promising approach to address the problem of distinguishing between AI and human-generated content. These schemes embed hidden signals within AI-generated content to enable reliable detection. While watermarking is not a silver bullet for addressing all risks associated with GenAI, it can play a crucial role in enhancing AI safety and trustworthiness by combating misinformation and deception. This paper presents a comprehensive overview of watermarking techniques for GenAI, beginning with the need for watermarking from historical and regulatory perspectives. We formalize the definitions and desired properties of watermarking schemes and examine the key objectives and threat models for existing approaches. Practical evaluation strategies are also explored, providing insights into the development of robust watermarking techniques capable of resisting various attacks. Additionally, we review recent representative works, highlight open challenges, and discuss potential directions for this emerging field. By offering a thorough understanding of watermarking in GenAI, this work aims to guide researchers in advancing watermarking methods and applications, and support policymakers in addressing the broader implications of GenAI.

Figures

Figures reproduced from arXiv: 2411.18479 by the authors.

Figure 1
Figure 1. Outline of the watermarking scenario. This figure illustrates the core components of watermarking [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 9 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Adaptively Robust LLM Monitoring via Activation Watermarking

    cs.CR 2026-03 conditional novelty 6.0 of 10

    Activation Watermarking embeds a secret keyed direction in an LLM's hidden states so policy-violating responses can be detected by a cosine test, cutting adaptive-jailbreak evasion relative to guard models.

  2. Pay for The Second-Best Service: A Game-Theoretic Approach Against Dishonest LLM Providers

    cs.GT 2025-11 conditional novelty 6.0 of 10

    A delegation mechanism makes near-truthful behavior approximately dominant for LLM API providers, and a matching impossibility result caps user utility at the second-best honest service.

  3. Optimizing Token Choice for Code Watermarking: An RL Approach

    cs.CR 2025-08 unverdicted novelty 6.0 of 10

    An RL-trained policy adaptively biases token choices to watermark LLM-generated code while preserving executable behavior.

  4. Watermark in the Classroom: A Conformal Framework for Adaptive AI Usage Detection

    stat.AP 2025-07 conditional novelty 6.0 of 10

    Standard, hierarchical, and weighted conformal prediction applied to LLM watermark scores can control false-positive rates when detecting guideline-violating AI edits in simulated classroom essays.

  5. Disappearing Ink: Obfuscation Breaks N-gram Code Watermarks in Theory and Practice

    cs.CR 2025-07 conditional novelty 6.0 of 10

    Obfuscation reduces detection of N-gram watermarked code to random guessing, and the authors prove this is unavoidable under a distribution consistency assumption.

  6. A Crack in the Bark: Leveraging Public Knowledge to Remove Tree-Ring Watermarks

    cs.CR 2025-06 conditional novelty 6.0 of 10

    VAE-recovered latent surrogates make Tree-Ring watermarks removable: ROC-AUC drops from 0.993 to 0.153 with little image quality loss.

  7. Adversarial Attacks for Good: A Survey of Proactive Protection across the Visual Content Lifecycle

    cs.CR 2026-08 accept novelty 5.0 of 10

    The paper unifies privacy filters, unlearnable examples, generative safeguards, adversarial CAPTCHAs, and provenance marks into a single 'adversarial attacks for good' lifecycle and evaluates them along three common axes.

  8. First-Place Solution to NeurIPS 2024 Invisible Watermark Removal Challenge

    cs.CV 2025-08 conditional novelty 4.0 of 10

    A competition-winning pipeline removes 95.7% of StegaStamp and TreeRing watermarks on the NeurIPS 2024 benchmark by combining VAE fine-tuning, diffusion purification, and translation tricks.

  9. Distributional Information Embedding: A Framework for Multi-bit Watermarking

    cs.CR 2025-01 reject novelty 4.0 of 10

    For i.i.d. tokens, the maximum reliable multi-bit watermarking rate equals the entropy of the LLM output distribution, growing with allowed distortion; the claimed finite-token optimal scheme is not fully supported by...

Reference graph

Works this paper leans on

148 extracted references · 26 canonical work pages · cited by 9 Pith papers

  1. [1]

    Chatgpt [large language model], 2022

    OpenAI. Chatgpt [large language model], 2022

    2022

  2. [2]

    Dall-e 3, 2023

    OpenAI. Dall-e 3, 2023

    2023

  3. [4]

    Gemini: a family of highly capable multimodal models.arXiv preprint arXiv:2312.11805, 2023

    Gemini Team, Rohan Anil, Sebastian Borgeaud, Jean-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M Dai, Anja Hauth, Katie Millican, et al. Gemini: a family of highly capable multimodal models.arXiv preprint arXiv:2312.11805, 2023

    arXiv 2023

  4. [5]

    Denoising diffusion probabilistic models.Advances in neural information processing systems, 33:6840–6851, 2020

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models.Advances in neural information processing systems, 33:6840–6851, 2020

    2020

  5. [6]

    High- resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj¨ orn Ommer. High- resolution image synthesis with latent diffusion models. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022

    2022

  6. [7]

    Generation ai: education reluctantly embraces the bots, 2023

    Barbara Lewis and Supantha Mukherjee. Generation ai: education reluctantly embraces the bots, 2023

    2023

  7. [8]

    Github copilot, 2021

    GitHub. Github copilot, 2021

    2021

  8. [9]

    Midjourney [text-to-image model], 2022

    Midjourney. Midjourney [text-to-image model], 2022

    2022

Show all 148 references
  1. [10]

    Highly accurate protein structure prediction with alphafold.nature, 596(7873):583–589, 2021

    John Jumper, Richard Evans, Alexander Pritzel, Tim Green, Michael Figurnov, Olaf Ronneberger, Kathryn Tunyasuvunakool, Russ Bates, Augustin ˇZ ´ ıdek, Anna Potapenko, et al. Highly accurate protein structure prediction with alphafold.nature, 596(7873):583–589, 2021

    2021

  2. [11]

    The ethical need for watermarks in machine-generated language.arXiv preprint arXiv:2209.03118, 2022

    Alexei Grinbaum and Laurynas Adomaitis. The ethical need for watermarks in machine-generated language.arXiv preprint arXiv:2209.03118, 2022

    2022 arXiv

  3. [12]

    Machine-generated text: A comprehensive survey of threat models and detection methods.IEEE Access, 11:70977–71002, 2023

    Evan N Crothers, Nathalie Japkowicz, and Herna L Viktor. Machine-generated text: A comprehensive survey of threat models and detection methods.IEEE Access, 11:70977–71002, 2023

    2023

  4. [13]

    A survey on detection of llms-generated content.arXiv preprint arXiv:2310.15654, 2023

    Xianjun Yang, Liangming Pan, Xuandong Zhao, Haifeng Chen, Linda Petzold, William Yang Wang, and Wei Cheng. A survey on detection of llms-generated content.arXiv preprint arXiv:2310.15654, 2023

    2023 arXiv

  5. [14]

    Deepfake generation and detection: A benchmark and survey.arXiv preprint arXiv:2403.17881, 2024

    Gan Pei, Jiangning Zhang, Menghan Hu, Zhenyu Zhang, Chengjie Wang, Yunsheng Wu, Guangtao Zhai, Jian Yang, Chunhua Shen, and Dacheng Tao. Deepfake generation and detection: A benchmark and survey.arXiv preprint arXiv:2403.17881, 2024

    2024

  6. [15]

    Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense.Advances in Neural Information Processing Systems, 36, 2024

    Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit Iyyer. Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense.Advances in Neural Information Processing Systems, 36, 2024

    2024

  7. [16]

    Deepfakes: a new threat to face recognition? assessment and detection.arXiv preprint arXiv:1812.08685, 2018

    Pavel Korshunov and S´ ebastien Marcel. Deepfakes: a new threat to face recognition? assessment and detection.arXiv preprint arXiv:1812.08685, 2018

    2018 arXiv

  8. [17]

    Detectgpt: Zero-shot machine-generated text detection using probability curvature

    Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D Manning, and Chelsea Finn. Detectgpt: Zero-shot machine-generated text detection using probability curvature. InInternational Conference on Machine Learning, pages 24950–24962. PMLR, 2023

    2023

  9. [18]

    Fast-detectgpt: Efficient zero-shot detection of machine-generated text via conditional probability curvature.arXiv preprint arXiv:2310.05130, 2023

    Guangsheng Bao, Yanbin Zhao, Zhiyang Teng, Linyi Yang, and Yue Zhang. Fast-detectgpt: Efficient zero-shot detection of machine-generated text via conditional probability curvature.arXiv preprint arXiv:2310.05130, 2023

    2023 arXiv

  10. [19]

    Radar: Robust ai-text detection via adversarial learning

    Xiaomeng Hu, Pin-Yu Chen, and Tsung-Yi Ho. Radar: Robust ai-text detection via adversarial learning. Advances in Neural Information Processing Systems, 36:15077–15095, 2023

    2023

  11. [20]

    Spotting llms with binoculars: Zero-shot detection of machine-generated text.arXiv preprint arXiv:2401.12070, 2024

    Abhimanyu Hans, Avi Schwarzschild, Valeriia Cherepanova, Hamid Kazemi, Aniruddha Saha, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Spotting llms with binoculars: Zero-shot detection of machine-generated text.arXiv preprint arXiv:2401.12070, 2024. 22

    2024 arXiv

  12. [21]

    Gpt detectors are biased against non-native english writers.Patterns, 4(7), 2023

    Weixin Liang, Mert Yuksekgonul, Yining Mao, Eric Wu, and James Zou. Gpt detectors are biased against non-native english writers.Patterns, 4(7), 2023

    2023

  13. [22]

    An examination of ai-generated text detectors across multiple domains and models.https://openreview.net/pdf ?id=Pu41DTYo2f, 2024

    Brian Tufts, Xuandong Zhao, and Lei Li. An examination of ai-generated text detectors across multiple domains and models.https://openreview.net/pdf ?id=Pu41DTYo2f, 2024

    2024

  14. [23]

    Red teaming language model detectors with language models.Transactions of the Association for Computational Linguistics, 12:174–189, 2024

    Zhouxing Shi, Yihan Wang, Fan Yin, Xiangning Chen, Kai-Wei Chang, and Cho-Jui Hsieh. Red teaming language model detectors with language models.Transactions of the Association for Computational Linguistics, 12:174–189, 2024

    2024

  15. [24]

    New ai classifier for indicating ai-written text, 2023

    OpenAI. New ai classifier for indicating ai-written text, 2023

    2023

  16. [25]

    Simons institute talk on watermarking of large language models, 2023

    Scott Aaronson. Simons institute talk on watermarking of large language models, 2023

    2023

  17. [26]

    A watermark for large language models

    John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. InInternational Conference on Machine Learning, pages 17061– 17084. PMLR, 2023

    2023

  18. [27]

    Provable robust water- marking for ai-generated text

    Xuandong Zhao, Prabhanjan Vijendra Ananth, Lei Li, and Yu-Xiang Wang. Provable robust water- marking for ai-generated text. InThe Twelfth International Conference on Learning Representations, 2024

    2024

  19. [28]

    Undetectable watermarks for language models

    Miranda Christ, Sam Gunn, and Or Zamir. Undetectable watermarks for language models. InThe Thirty Seventh Annual Conference on Learning Theory, pages 1125–1139. PMLR, 2024

    2024

  20. [29]

    Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust.arXiv preprint arXiv:2305.20030, 2023

    Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust.arXiv preprint arXiv:2305.20030, 2023

    2023 arXiv

  21. [30]

    An undetectable watermark for generative image models

    Sam Gunn, Xuandong Zhao, and Dawn Song. An undetectable watermark for generative image models. arXiv preprint arXiv:2410.07369, 2024

    2024 arXiv

  22. [31]

    Wavmark: Watermarking for audio generation.arXiv preprint arXiv:2308.12770, 2023

    Guangyu Chen, Yu Wu, Shujie Liu, Tao Liu, Xiaoyong Du, and Furu Wei. Wavmark: Watermarking for audio generation.arXiv preprint arXiv:2308.12770, 2023

    2023 arXiv

  23. [32]

    Proactive detection of voice cloning with localized watermarking

    Robin San Roman, Pierre Fernandez, Hady Elsahar, Alexandre D´ efossez, Teddy Furon, and Tuan Tran. Proactive detection of voice cloning with localized watermarking. InInternational Conference on Machine Learning, volume 235, 2024

    2024

  24. [33]

    Waves: Benchmarking the robustness of image watermarks

    Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, et al. Waves: Benchmarking the robustness of image watermarks. InForty-first International Conference on Machine Learning, 2024

    2024

  25. [34]

    Watermark-based detection and attribution of ai-generated content.arXiv preprint arXiv:2404.04254, 2024

    Zhengyuan Jiang, Moyang Guo, Yuepeng Hu, and Neil Zhenqiang Gong. Watermark-based detection and attribution of ai-generated content.arXiv preprint arXiv:2404.04254, 2024

    2024

  26. [35]

    Morgan kaufmann, 2007

    Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker.Digital watermarking and steganography. Morgan kaufmann, 2007

    2007

  27. [36]

    A survey of deep neural network watermarking techniques

    Yue Li, Hongxia Wang, and Mauro Barni. A survey of deep neural network watermarking techniques. Neurocomputing, 461:171–193, 2021

    2021

  28. [37]

    A systematic review on model watermarking for neural networks.Frontiers in big Data, 4:729663, 2021

    Franziska Boenisch. A systematic review on model watermarking for neural networks.Frontiers in big Data, 4:729663, 2021

    2021

  29. [38]

    Survey on watermarking methods in the artificial intelligence domain and beyond.Computer Communications, 188:52–65, 2022

    Preetam Amrit and Amit Kumar Singh. Survey on watermarking methods in the artificial intelligence domain and beyond.Computer Communications, 188:52–65, 2022

    2022

  30. [39]

    Watermax: breaking the llm watermark detectability-robustness-quality trade-off.arXiv preprint arXiv:2403.04808, 2024

    Eva Giboulot and Teddy Furon. Watermax: breaking the llm watermark detectability-robustness-quality trade-off.arXiv preprint arXiv:2403.04808, 2024

    2024 arXiv

  31. [40]

    The Mill, 1916

    Dard Hunter.Hand made paper and its water marks: a bibliography, volume 2. The Mill, 1916

    1916

  32. [41]

    A digital watermark

    Ron G Van Schyndel, Andrew Z Tirkel, and Charles F Osborne. A digital watermark. InProceedings of 1st international conference on image processing, volume 2, pages 86–90. IEEE, 1994. 23

    1994

  33. [42]

    Attacking visible watermarking schemes.IEEE transactions on multimedia, 6(1):16–30, 2004

    Chun-Hsiang Huang and Ja-Ling Wu. Attacking visible watermarking schemes.IEEE transactions on multimedia, 6(1):16–30, 2004

    2004

  34. [43]

    On the effectiveness of visible watermarks

    Tali Dekel, Michael Rubinstein, Ce Liu, and William T Freeman. On the effectiveness of visible watermarks. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 2146–2154, 2017

    2017

  35. [44]

    Ai models collapse when trained on recursively generated data.Nature, 631(8022):755–759, 2024

    Ilia Shumailov, Zakhar Shumaylov, Yiren Zhao, Nicolas Papernot, Ross Anderson, and Yarin Gal. Ai models collapse when trained on recursively generated data.Nature, 631(8022):755–759, 2024

    2024

  36. [45]

    Order No

    Exec. Order No. 1411. 88 FR 75191, 2023

    2023

  37. [46]

    Cal. Senate. California AI Transparency Act. SB 942, 2024

    2024

  38. [47]

    Cal. Senate. California Digital Content Provenance Standards. AB 3211, 2024

    2024

  39. [48]

    SB 217, 2024

    Ohio Senate. SB 217, 2024

    2024

  40. [49]

    Advisory for AI-Generated Content Act

    118th Congress. Advisory for AI-Generated Content Act. S. 2765, 2023

    2023

  41. [50]

    AI Labeling Act

    118th Congress. AI Labeling Act. S. 2691, 2023

    2023

  42. [51]

    COPIED Act, 2024

    118th Congress. COPIED Act, 2024

    2024

  43. [52]

    Artificial Intelligence Research, Innovation, and Accountability Act

    118th Congress. Artificial Intelligence Research, Innovation, and Accountability Act. S. 3312, 2023

    2023

  44. [53]

    EU AI Act, 2024

    EU Parliament and Council. EU AI Act, 2024

    2024

  45. [54]

    Provisions on the Administration of Deep Synthesis Internet Information Services, 2022

    Cyberspace Administration of China. Provisions on the Administration of Deep Synthesis Internet Information Services, 2022

    2022

  46. [55]

    Content Industry Promotion Act, 2024

    National Assembly of South Korea. Content Industry Promotion Act, 2024

    2024

  47. [56]

    Securing the Future of GenAI: Policy and Technology.Cryptology ePrint Archive, 2024

    Mihai Christodorescu, Ryan Craven, Soheil Feizi, Neil Gong, Mia Hoffmann, Somesh Jha, Zhengyuan Jiang, Mehrdad Saberi Kamarposhti, John Mitchell, Jessica Newman, et al. Securing the Future of GenAI: Policy and Technology.Cryptology ePrint Archive, 2024

    2024

  48. [57]

    Identifying AI-generated content with SynthID, 2024

    Google DeepMind. Identifying AI-generated content with SynthID, 2024

    2024

  49. [58]

    Scalable watermarking for identifying large language model outputs.Nature, 634(8035):818–823, 2024

    Sumanth Dathathri, Abigail See, Sumedh Ghaisas, Po-Sen Huang, Rob McAdam, Johannes Welbl, Vandana Bachani, Alex Kaskasoli, Robert Stanforth, Tatiana Matejovicova, et al. Scalable watermarking for identifying large language model outputs.Nature, 634(8035):818–823, 2024

    2024

  50. [59]

    Openai, google, others pledge to watermark ai content for safety, white house says, Jul 2023

    Diane Bartz and Krystal Hu. Openai, google, others pledge to watermark ai content for safety, white house says, Jul 2023

    2023

  51. [60]

    Microsoft pledges to watermark ai-generated images and videos.TechCrunch blog, 2023

    Kyle Wiggers. Microsoft pledges to watermark ai-generated images and videos.TechCrunch blog, 2023

    2023

  52. [61]

    Coalition for Content provenance and authenticity, 2024

    C2PA. Coalition for Content provenance and authenticity, 2024

    2024

  53. [62]

    C2PA Specifications, 2023

    C2PA. C2PA Specifications, 2023

    2023

  54. [63]

    Generate text using the Gemini API, 2024

    Google AI. Generate text using the Gemini API, 2024

    2024

  55. [64]

    Transforming the future of music creation, 2023

    Google DeepMind. Transforming the future of music creation, 2023

    2023

  56. [65]

    Imagen video: High definition video generation with diffusion models.arXiv preprint arXiv:2210.02303, 2022

    Jonathan Ho, William Chan, Chitwan Saharia, Jay Whang, Ruiqi Gao, Alexey Gritsenko, Diederik P Kingma, Ben Poole, Mohammad Norouzi, David J Fleet, et al. Imagen video: High definition video generation with diffusion models.arXiv preprint arXiv:2210.02303, 2022

    arXiv

  57. [66]

    Introducing VideoFX, plus new features for ImageFX and MusicFX, 2024

    Thomas Iljic and Kristin Yim. Introducing VideoFX, plus new features for ImageFX and MusicFX, 2024

    2024

  58. [67]

    SynthID: Tools for watermarking and detecting LLM-generated Text, 2024

    Google AI. SynthID: Tools for watermarking and detecting LLM-generated Text, 2024

    2024

  59. [68]

    Robust distortion-free watermarks for language models.arXiv preprint arXiv:2307.15593, 2023

    Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. Robust distortion-free watermarks for language models.arXiv preprint arXiv:2307.15593, 2023. 24

    2023 arXiv

  60. [69]

    Gaussian shading: Provable performance-lossless image watermarking for diffusion models

    Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shading: Provable performance-lossless image watermarking for diffusion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12162–12171, 2024

    2024

  61. [70]

    Evading watermark based detection of ai-generated content

    Zhengyuan Jiang, Jinghuai Zhang, and Neil Zhenqiang Gong. Evading watermark based detection of ai-generated content. InProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pages 1168–1181, 2023

    2023

  62. [71]

    Nikola Jovanovic, Robin Staab, and Martin T. Vechev. Watermark stealing in large language models. InForty-first International Conference on Machine Learning, ICML 2024, Vienna, Austria, July 21-27, 2024, 2024

    2024

  63. [72]

    No free lunch in llm watermarking: Trade-offs in watermarking design choices.arXiv preprint arXiv:2402.16187, 2024

    Qi Pang, Shengyuan Hu, Wenting Zheng, and Virginia Smith. No free lunch in llm watermarking: Trade-offs in watermarking design choices.arXiv preprint arXiv:2402.16187, 2024

    2024 arXiv

  64. [73]

    Pseudorandom error-correcting codes

    Miranda Christ and Sam Gunn. Pseudorandom error-correcting codes. In Leonid Reyzin and Douglas Stebila, editors,Advances in Cryptology - CRYPTO 2024 - 44th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 18-22, 2024, Proceedings, Part VI, volume 1492...

    2024

  65. [74]

    Edit distance robust watermarks via indexing pseudorandom codes

    Noah Golowich and Ankur Moitra. Edit distance robust watermarks via indexing pseudorandom codes. InThe Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024

    2024

  66. [75]

    Publicly detectable watermarking for language models.arXiv preprint arXiv:2310.18491, 2023

    Jaiden Fairoze, Sanjam Garg, Somesh Jha, Saeed Mahloujifar, Mohammad Mahmoody, and Mingyuan Wang. Publicly detectable watermarking for language models.arXiv preprint arXiv:2310.18491, 2023

    2023 arXiv

  67. [76]

    Invisible image watermarks are provably removable using generative ai.Advances in neural information processing systems, 2024

    Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative ai.Advances in neural information processing systems, 2024

    2024

  68. [77]

    Steganalysis on digital watermarking: Is your defense truly impervious? InThe Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024

    Pei Yang, Hai Ci, Yiren Song, and Mike Zheng Shou. Steganalysis on digital watermarking: Is your defense truly impervious? InThe Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024

    2024

  69. [78]

    Watermarks in the sand: Impossibility of strong watermarking for generative models.arXiv preprint arXiv:2311.04378, 2023

    Hanlin Zhang, Benjamin L Edelman, Danilo Francati, Daniele Venturi, Giuseppe Ateniese, and Boaz Barak. Watermarks in the sand: Impossibility of strong watermarking for generative models.arXiv preprint arXiv:2311.04378, 2023

    2023 arXiv

  70. [79]

    Mark my words: Analyzing and evaluating language model watermarks.arXiv preprint arXiv:2312.00273, 2023

    Julien Piet, Chawin Sitawarin, Vivian Fang, Norman Mu, and David Wagner. Mark my words: Analyzing and evaluating language model watermarks.arXiv preprint arXiv:2312.00273, 2023

    2023 arXiv

  71. [80]

    Markllm: An open-source toolkit for llm watermarking.arXiv preprint arXiv:2405.10051, 2024

    Leyi Pan, Aiwei Liu, Zhiwei He, Zitian Gao, Xuandong Zhao, Yijian Lu, Binglin Zhou, Shuliang Liu, Xuming Hu, Lijie Wen, et al. Markllm: An open-source toolkit for llm watermarking.arXiv preprint arXiv:2405.10051, 2024

    2024 arXiv

  72. [81]

    Robustness of ai-image detectors: Fundamental limits and practical attacks

    Mehrdad Saberi, Vinu Sankar Sadasivan, Keivan Rezaei, Aounon Kumar, Atoosa Chegini, Wenxiao Wang, and Soheil Feizi. Robustness of ai-image detectors: Fundamental limits and practical attacks. In The Twelfth International Conference on Learning Representations, 2024

    2024

  73. [82]

    On the learnability of watermarks for language models.arXiv preprint arXiv:2312.04469, 2023

    Chenchen Gu, Xiang Lisa Li, Percy Liang, and Tatsunori Hashimoto. On the learnability of watermarks for language models.arXiv preprint arXiv:2312.04469, 2023

    2023 arXiv

  74. [83]

    Towards deep learning models resistant to adversarial attacks.ArXiv, abs/1706.06083, 2017

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks.ArXiv, abs/1706.06083, 2017

    2017 arXiv

  75. [84]

    Texygen: A benchmarking platform for text generation models

    Yaoming Zhu, Sidi Lu, Lei Zheng, Jiaxian Guo, Weinan Zhang, Jun Wang, and Yong Yu. Texygen: A benchmarking platform for text generation models. InThe 41st international ACM SIGIR conference on research & development in information retrieval, pages 1097–1100, 2018

    2018

  76. [85]

    Mauve: Measuring the gap between neural text and human text using divergence frontiers.Advances in Neural Information Processing Systems, 34:4816–4828, 2021

    Krishna Pillutla, Swabha Swayamdipta, Rowan Zellers, John Thickstun, Sean Welleck, Yejin Choi, and Zaid Harchaoui. Mauve: Measuring the gap between neural text and human text using divergence frontiers.Advances in Neural Information Processing Systems, 34:4816–4828, 2021. 25

    2021

  77. [86]

    Judging llm-as-a-judge with mt-bench and chatbot arena

    Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric Xing, et al. Judging llm-as-a-judge with mt-bench and chatbot arena. Advances in Neural Information Processing Systems, 36:46595–46623, 2023

    2023

  78. [87]

    Rouge: A package for automatic evaluation of summaries

    Chin-Yew Lin. Rouge: A package for automatic evaluation of summaries. InText summarization branches out, pages 74–81, 2004

    2004

  79. [88]

    Bleu: a method for automatic evaluation of machine translation

    Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu. Bleu: a method for automatic evaluation of machine translation. InProceedings of the 40th annual meeting of the Association for Computational Linguistics, pages 311–318, 2002

    2002

  80. [89]

    Bertscore: Evaluating text generation with bert.arXiv preprint arXiv:1904.09675, 2019

    Tianyi Zhang, Varsha Kishore, Felix Wu, Kilian Q Weinberger, and Yoav Artzi. Bertscore: Evaluating text generation with bert.arXiv preprint arXiv:1904.09675, 2019

    1904 arXiv

  81. [90]

    Bartscore: Evaluating generated text as text generation

    Weizhe Yuan, Graham Neubig, and Pengfei Liu. Bartscore: Evaluating generated text as text generation. Advances in Neural Information Processing Systems, 34:27263–27277, 2021

    2021

  82. [91]

    Instructscore: Towards explainable text generation evaluation with automatic feedback

    Wenda Xu, Danqing Wang, Liangming Pan, Zhenqiao Song, Markus Freitag, William Wang, and Lei Li. Instructscore: Towards explainable text generation evaluation with automatic feedback. InProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, page...

    2023

  83. [92]

    GANs trained by a two time-scale update rule converge to a local nash equilibrium.Advances in neural information processing systems, 30, 2017

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. GANs trained by a two time-scale update rule converge to a local nash equilibrium.Advances in neural information processing systems, 30, 2017

    2017

  84. [93]

    Learning transferable visual models from natural language supervision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. InInternational conference on machine learning, pag...

    2021

  85. [94]

    Improved techniques for training GANs.Advances in neural information processing systems, 29, 2016

    Tim Salimans, Ian Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen. Improved techniques for training GANs.Advances in neural information processing systems, 29, 2016

    2016

  86. [95]

    The unreasonable effectiveness of deep features as a perceptual metric

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 586–595, 2018

    2018

  87. [96]

    Dreamsim: Learning new dimensions of human visual similarity using synthetic data.arXiv preprint arXiv:2306.09344, 2023

    Stephanie Fu, Netanel Tamir, Shobhita Sundaram, Lucy Chai, Richard Zhang, Tali Dekel, and Phillip Isola. Dreamsim: Learning new dimensions of human visual similarity using synthetic data.arXiv preprint arXiv:2306.09344, 2023

    2023 arXiv

  88. [97]

    Blip: Bootstrapping language-image pre- training for unified vision-language understanding and generation

    Junnan Li, Dongxu Li, Caiming Xiong, and Steven Hoi. Blip: Bootstrapping language-image pre- training for unified vision-language understanding and generation. InInternational conference on machine learning, pages 12888–12900. PMLR, 2022

    2022

  89. [98]

    Imagereward: Learning and evaluating human preferences for text-to-image generation.Advances in Neural Information Processing Systems, 36, 2024

    Jiazheng Xu, Xiao Liu, Yuchen Wu, Yuxuan Tong, Qinkai Li, Ming Ding, Jie Tang, and Yuxiao Dong. Imagereward: Learning and evaluating human preferences for text-to-image generation.Advances in Neural Information Processing Systems, 36, 2024

    2024

  90. [99]

    A survey of text watermarking in the era of large language models.ACM Computing Surveys, 57(2):1–36, 2024

    Aiwei Liu, Leyi Pan, Yijian Lu, Jingjing Li, Xuming Hu, Xi Zhang, Lijie Wen, Irwin King, Hui Xiong, and Philip Yu. A survey of text watermarking in the era of large language models.ACM Computing Surveys, 57(2):1–36, 2024

    2024

  91. [100]

    Unispach: A text-based data hiding method using unicode space characters.Journal of Systems and Software, 85(5):1075–1082, 2012

    Lip Yee Por, KokSheik Wong, and Kok Onn Chee. Unispach: A text-based data hiding method using unicode space characters.Journal of Systems and Software, 85(5):1075–1082, 2012

    2012

  92. [101]

    Embarrassingly simple text watermarks.arXiv preprint arXiv:2310.08920, 2023

    Ryoma Sato, Yuki Takezawa, Han Bao, Kenta Niwa, and Makoto Yamada. Embarrassingly simple text watermarks.arXiv preprint arXiv:2310.08920, 2023

    2023 arXiv

  93. [102]

    Wordnet: An electronic lexical database.MIT Press google schola, 2:678–686, 1998

    Christiane Fellbaum. Wordnet: An electronic lexical database.MIT Press google schola, 2:678–686, 1998. 26

    1998

  94. [103]

    Bert: Pre-training of deep bidirectional transformers for language understanding

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. InNorth American Chapter of the Association for Computational Linguistics, 2019

    2019

  95. [104]

    Natural language watermarking: Design, analysis, and a proof-of-concept implementation

    Mikhail J Atallah, Victor Raskin, Michael Crogan, Christian Hempelmann, Florian Kerschbaum, Dina Mohamed, and Sanket Naik. Natural language watermarking: Design, analysis, and a proof-of-concept implementation. InInformation Hiding: 4th International Workshop, IH 2001 Pittsbur...

    2001

  96. [105]

    On the reliability of watermarks for large language models

    John Kirchenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fernando, Aniruddha Saha, Micah Goldblum, and Tom Goldstein. On the reliability of watermarks for large language models. InThe Twelfth International Conference on Learning Representations, 2024

    2024

  97. [106]

    Who wrote this code? watermarking for code generation.arXiv preprint arXiv:2305.15060, 2023

    Taehyun Lee, Seokhee Hong, Jaewoo Ahn, Ilgee Hong, Hwaran Lee, Sangdoo Yun, Jamin Shin, and Gunhee Kim. Who wrote this code? watermarking for code generation.arXiv preprint arXiv:2305.15060, 2023

    2023 arXiv

  98. [107]

    An unforgeable publicly verifiable watermark for large language models

    Aiwei Liu, Leyi Pan, Xuming Hu, Shuang Li, Lijie Wen, Irwin King, and S Yu Philip. An unforgeable publicly verifiable watermark for large language models. InThe Twelfth International Conference on Learning Representations, 2023

    2023

  99. [108]

    Adaptive text watermark for large language models

    Yepeng Liu and Yuheng Bu. Adaptive text watermark for large language models. InInternational Conference on Machine Learning (ICML-24), 2024

    2024

  100. [109]

    Token-specific watermarking with enhanced detectability and semantic coherence for large language models

    Mingjia Huo, Sai Ashish Somayajula, Youwei Liang, Ruisi Zhang, Farinaz Koushanfar, and Pengtao Xie. Token-specific watermarking with enhanced detectability and semantic coherence for large language models. InInternational Conference on Machine Learning (ICML-24), 2024

    2024

  101. [110]

    Bileve: Securing text provenance in large language models against spoofing with bi-level signature.arXiv preprint arXiv:2406.01946, 2024

    Tong Zhou, Xuandong Zhao, Xiaolin Xu, and Shaolei Ren. Bileve: Securing text provenance in large language models against spoofing with bi-level signature.arXiv preprint arXiv:2406.01946, 2024

    2024 arXiv

  102. [111]

    Prov- ably robust multi-bit watermarking for ai-generated text via error correction code.arXiv preprint arXiv:2401.16820, 2024

    Wenjie Qu, Dong Yin, Zixin He, Wei Zou, Tianyang Tao, Jinyuan Jia, and Jiaheng Zhang. Prov- ably robust multi-bit watermarking for ai-generated text via error correction code.arXiv preprint arXiv:2401.16820, 2024

    2024 arXiv

  103. [112]

    Semstamp: A semantic watermark with paraphrastic robustness for text generation.arXiv preprint arXiv:2310.03991, 2023

    Abe Bohan Hou, Jingyu Zhang, Tianxing He, Yichen Wang, Yung-Sung Chuang, Hongwei Wang, Lingfeng Shen, Benjamin Van Durme, Daniel Khashabi, and Yulia Tsvetkov. Semstamp: A semantic watermark with paraphrastic robustness for text generation.arXiv preprint arXiv:2310.03991, 2023

    arXiv

  104. [113]

    The stable signature: Rooting watermarks in latent diffusion models

    Pierre Fernandez, Guillaume Couairon, Herv´ e J´ egou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 22466–22477, 2023

    2023

  105. [114]

    Unbiased watermark for large language models.arXiv preprint arXiv:2310.10669, 2023

    Zhengmian Hu, Lichang Chen, Xidong Wu, Yihan Wu, Hongyang Zhang, and Heng Huang. Unbiased watermark for large language models.arXiv preprint arXiv:2310.10669, 2023

    2023 arXiv

  106. [115]

    Watermark- ing images in self-supervised latent spaces

    Pierre Fernandez, Alexandre Sablayrolles, Teddy Furon, Herv´ e J´ egou, and Matthijs Douze. Watermark- ing images in self-supervised latent spaces. InICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 3054–3058. IEEE, 2022

    2022

  107. [116]

    A resilient and accessible distribution-preserving watermark for large language models

    Yihan Wu, Zhengmian Hu, Junfeng Guo, Hongyang Zhang, and Heng Huang. A resilient and accessible distribution-preserving watermark for large language models. InForty-first International Conference on Machine Learning, 2024

    2024

  108. [117]

    Permute-and-flip: An optimally robust and watermarkable decoder for llms.arXiv preprint arXiv:2402.05864, 2024

    Xuandong Zhao, Lei Li, and Yu-Xiang Wang. Permute-and-flip: An optimally robust and watermarkable decoder for llms.arXiv preprint arXiv:2402.05864, 2024

    2024 arXiv

  109. [118]

    GumbelSoft: Diversified language model watermarking via the GumbelMax-trick

    Jiayi Fu, Xuandong Zhao, Ruihan Yang, Yuansen Zhang, Jiangjie Chen, and Yanghua Xiao. GumbelSoft: Diversified language model watermarking via the GumbelMax-trick. InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers),...

    2024

  110. [119]

    Watermarking language models for many adaptive users

    Aloni Cohen, Alexander Hoover, and Gabe Schoenbach. Watermarking language models for many adaptive users. In2025 IEEE Symposium on Security and Privacy (SP), pages 84–84. IEEE Computer Society, 2024

    2024

  111. [120]

    New constructions of pseudorandom codes.arXiv preprint arXiv:2409.07580, 2024

    Surendra Ghentiyala and Venkatesan Guruswami. New constructions of pseudorandom codes.arXiv preprint arXiv:2409.07580, 2024

    2024 arXiv

  112. [121]

    Approximate nearest neighbors: towards removing the curse of dimensionality

    Piotr Indyk and Rajeev Motwani. Approximate nearest neighbors: towards removing the curse of dimensionality. InProceedings of the thirtieth annual ACM symposium on Theory of computing, pages 604–613, 1998

    1998

  113. [122]

    k-semstamp: A clustering-based semantic watermark for detection of machine-generated text.arXiv preprint arXiv:2402.11399, 2024

    Abe Bohan Hou, Jingyu Zhang, Yichen Wang, Daniel Khashabi, and Tianxing He. k-semstamp: A clustering-based semantic watermark for detection of machine-generated text.arXiv preprint arXiv:2402.11399, 2024

    2024 arXiv

  114. [123]

    Combined dwt-dct digital image watermarking.Journal of computer science, 3(9):740–746, 2007

    Ali Al-Haj. Combined dwt-dct digital image watermarking.Journal of computer science, 3(9):740–746, 2007

    2007

  115. [124]

    Dwt-dct-svd based watermarking

    KA Navas, Mathews Cheriyan Ajay, M Lekshmi, Tampy S Archana, and M Sasikumar. Dwt-dct-svd based watermarking. In2008 3rd international conference on communication systems software and middleware and workshops (COMSWARE’08), pages 271–274. IEEE, 2008

    2008

  116. [125]

    Hidden: Hiding data with deep networks

    Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. InEuropean Conference on Computer Vision, 2018

    2018

  117. [126]

    Robust invisible video watermarking with attention.arXiv preprint arXiv:1909.01285, 2019

    Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention.arXiv preprint arXiv:1909.01285, 2019

    1909 arXiv

  118. [127]

    Stegastamp: Invisible hyperlinks in physical photographs

    Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical photographs. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2117–2126, 2020

    2020

  119. [128]

    A recipe for watermarking diffusion models.arXiv preprint arXiv:2303.10137, 2023

    Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Ngai-Man Cheung, and Min Lin. A recipe for watermarking diffusion models.arXiv preprint arXiv:2303.10137, 2023

    2023 arXiv

  120. [129]

    Denoising diffusion implicit models

    Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. InInternational Conference on Learning Representations, 2021

    2021

  121. [130]

    Robust image watermarking using stable diffusion.arXiv preprint arXiv:2401.04247, 2024

    Lijun Zhang, Xiao Liu, Antoni Viros Martin, Cindy Xiong Bearfield, Yuriy Brun, and Hui Guan. Robust image watermarking using stable diffusion.arXiv preprint arXiv:2401.04247, 2024

    2024 arXiv

  122. [131]

    RingID: Rethinking Tree-Ring watermarking for enhanced multi-key identification.arXiv preprint arXiv:2404.14055, 2024

    Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. RingID: Rethinking Tree-Ring watermarking for enhanced multi-key identification.arXiv preprint arXiv:2404.14055, 2024

    2024 arXiv

  123. [132]

    Overview of fine granularity scalability in mpeg-4 video standard.IEEE Trans

    Weiping Li. Overview of fine granularity scalability in mpeg-4 video standard.IEEE Trans. Circuits Syst. Video Technol., 11:301–317, 2001

    2001

  124. [133]

    An overview of digital video watermarking.IEEE Transactions on Circuits and Systems for Video Technology, 28(9):2131–2153, 2017

    Md Asikuzzaman and Mark R Pickering. An overview of digital video watermarking.IEEE Transactions on Circuits and Systems for Video Technology, 28(9):2131–2153, 2017

    2017

  125. [134]

    Dvmark: a deep multiscale framework for video watermarking.IEEE Transactions on Image Processing, 2023

    Xiyang Luo, Yinxiao Li, Huiwen Chang, Ce Liu, Peyman Milanfar, and Feng Yang. Dvmark: a deep multiscale framework for video watermarking.IEEE Transactions on Image Processing, 2023

    2023

  126. [135]

    Attributable watermarking of speech generative models

    Yongbaek Cho, Changhoon Kim, Yezhou Yang, and Yi Ren. Attributable watermarking of speech generative models. InICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 3069–3073. IEEE, 2022

    2022

  127. [136]

    Enhancing robustness of speech watermarking using a transformer-based framework exploiting acoustic features.IEEE/ACM Transactions on Audio, Speech, and Language Processing, 2024

    Chuxuan Tong, Iynkaran Natgunanathan, Yong Xiang, Jianhua Li, Tianrui Zong, Xi Zheng, and Longxiang Gao. Enhancing robustness of speech watermarking using a transformer-based framework exploiting acoustic features.IEEE/ACM Transactions on Audio, Speech, and Language Processing...

    2024

  128. [137]

    Detecting voice cloning attacks via timbre watermarking.arXiv preprint arXiv:2312.03410, 2023

    Chang Liu, Jie Zhang, Tianwei Zhang, Xi Yang, Weiming Zhang, and Nenghai Yu. Detecting voice cloning attacks via timbre watermarking.arXiv preprint arXiv:2312.03410, 2023

    2023 arXiv

  129. [138]

    Groot: Generating robust watermark for diffusion-model-based audio synthesis

    Weizhi Liu, Yue Li, Dongdong Lin, Hui Tian, and Haizhou Li. Groot: Generating robust watermark for diffusion-model-based audio synthesis. InProceedings of the 32nd ACM International Conference on Multimedia, pages 3294–3302, 2024

    2024

  130. [139]

    Audiomarkbench: Benchmarking robustness of audio watermarking.arXiv preprint arXiv:2406.06979, 2024

    Hongbin Liu, Moyang Guo, Zhengyuan Jiang, Lun Wang, and Neil Zhenqiang Gong. Audiomarkbench: Benchmarking robustness of audio watermarking.arXiv preprint arXiv:2406.06979, 2024

    2024 arXiv

  131. [140]

    Chameleon: Mixed-modal early-fusion foundation models.arXiv preprint arXiv:2405.09818, 2024

    Chameleon Team. Chameleon: Mixed-modal early-fusion foundation models.arXiv preprint arXiv:2405.09818, 2024

    2024 arXiv

  132. [141]

    V2a-mark: Versatile deep visual-audio watermarking for manipulation localization and copyright protection

    Xuanyu Zhang, Youmin Xu, Runyi Li, Jiwen Yu, Weiqi Li, Zhipei Xu, and Jian Zhang. V2a-mark: Versatile deep visual-audio watermarking for manipulation localization and copyright protection. In Proceedings of the 32nd ACM International Conference on Multimedia, pages 9818–9827, 2024

    2024

  133. [142]

    Language models are realistic tabular data generators.arXiv preprint arXiv:2210.06280, 2022

    Vadim Borisov, Kathrin Seßler, Tobias Leemann, Martin Pawelczyk, and Gjergji Kasneci. Language models are realistic tabular data generators.arXiv preprint arXiv:2210.06280, 2022

    2022 arXiv

  134. [143]

    Towards optimal statistical watermarking.arXiv preprint arXiv:2312.07930, 2023

    Baihe Huang, Hanlin Zhu, Banghua Zhu, Kannan Ramchandran, Michael I Jordan, Jason D Lee, and Jiantao Jiao. Towards optimal statistical watermarking.arXiv preprint arXiv:2312.07930, 2023

    2023 arXiv

  135. [144]

    A statistical framework of watermarks for large language models: Pivot, detection efficiency and optimal rules.arXiv preprint arXiv:2404.01245, 2024

    Xiang Li, Feng Ruan, Huiyuan Wang, Qi Long, and Weijie J Su. A statistical framework of watermarks for large language models: Pivot, detection efficiency and optimal rules.arXiv preprint arXiv:2404.01245, 2024

    2024 arXiv

  136. [145]

    Cater: Intellectual property protection on text generation apis via conditional watermarks.Advances in Neural Information Processing Systems, 35:5431–5445, 2022

    Xuanli He, Qiongkai Xu, Yi Zeng, Lingjuan Lyu, Fangzhao Wu, Jiwei Li, and Ruoxi Jia. Cater: Intellectual property protection on text generation apis via conditional watermarks.Advances in Neural Information Processing Systems, 35:5431–5445, 2022

    2022

  137. [146]

    Distillation-resistant watermarking for model protection in nlp.arXiv preprint arXiv:2210.03312, 2022

    Xuandong Zhao, Lei Li, and Yu-Xiang Wang. Distillation-resistant watermarking for model protection in nlp.arXiv preprint arXiv:2210.03312, 2022

    2022 arXiv

  138. [147]

    Protecting language generation models via invisible watermarking

    Xuandong Zhao, Yu-Xiang Wang, and Lei Li. Protecting language generation models via invisible watermarking. InInternational Conference on Machine Learning, pages 42187–42199. PMLR, 2023

    2023

  139. [148]

    Domain watermark: Effective and harmless dataset copyright protection is closed at hand.Advances in Neural Information Processing Systems, 36, 2024

    Junfeng Guo, Yiming Li, Lixu Wang, Shu-Tao Xia, Heng Huang, Cong Liu, and Bo Li. Domain watermark: Effective and harmless dataset copyright protection is closed at hand.Advances in Neural Information Processing Systems, 36, 2024

    2024

  140. [149]

    Proving membership in llm pretraining data via data watermarks.arXiv preprint arXiv:2402.10892, 2024

    Johnny Tian-Zheng Wei, Ryan Yixiang Wang, and Robin Jia. Proving membership in llm pretraining data via data watermarks.arXiv preprint arXiv:2402.10892, 2024. 29

    2024 arXiv

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.