Pith. sign in

REVIEW 3 major objections 4 minor 33 references

Watermarking across Modalities for Content Tracing and Generative AI

T0 review · 3 major / 4 minor · reviewed 2026-08-09 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The thesis claims that generative models can be adapted so that all their outputs—images, audio, and text—contain an invisible watermark detectable with provably low false positive rates.

desk verdict A faithful thesis compiling seven peer-reviewed watermarking papers; the synthesis is honest and the code is mostly available, but the standalone novelty is nil and the FPR guarantees rest on an empirical i.i.d. assumption. read the letter →

arxiv 2502.05215 v1 pith:RCELGPZR submitted 2025-02-04 cs.CR cs.AIcs.LG

Pierre Fernandez This is my paper · ORCID
classification cs.CRcs.AIcs.LG
keywords watermarkinggenerativeAIcontenttracinglatentdiffusionmodelslargelanguagestatisticalhypothesistestingcopydetectionmodelmonitoring
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The thesis argues that watermarking can be made a practical, provably reliable tool for the generative-AI era, across images, speech, and text. Its central claim is that a model provider can adapt a generative model—most notably by fine-tuning the latent decoder of a diffusion model—so that every output it produces conceals an invisible signature, recoverable by a fixed extractor and checked by a statistical test with a controlled false positive rate. The same statistical machinery is carried through to audio (with detection localized to 1/16,000-second steps), to text (with improved binomial tests for large-language-model watermarks), and to model monitoring (detecting a watermark in a model fine-tuned on watermarked text, and watermarking transformer weights through functional invariants). If the methods work as claimed, content moderators, platforms, and model providers get a technical basis for tracing synthetic content and detecting misuse that does not rely on brittle forensic artifacts.

What carries the argument

The load-bearing objects are: (1) the fixed watermark extractor, trained as a HiDDeN-style encoder/decoder with an attack simulation layer, then appended with a PCA-whitening linear layer so that bits extracted from vanilla content are near-i.i.d. Bernoulli(0.5); (2) the binomial detection test, FPR(τ)=I_{1/2}(τ,k−τ+1), applied to the number of matching bits, which converts a decoded message into a controlled false positive rate for both detection and identification (with the N-hypothesis correction); (3) for latent diffusion models, the fine-tuned latent decoder D_m, optimized by back-propagating a message loss and a Watson-VGG perceptual loss so that the generated images are watermarked and visually unchanged; (4) the hypercone detector in PCA-whitened SSL latent spaces for the content-moderation chapters; and (5) functional invariants—dimension permutations and scaling/unscaling—used to watermark transformer weights without training. Each of these turns an imperceptible modification into a statistical test with a quantifiable error rate.

What would settle it

Take a corpus of images from a distribution far from the one used to fit the PCA-whitening layer (for example, X-ray images, screenshots of text, or heavy JPEG artifacts), extract the bits with the published extractor, and test the i.i.d. Bernoulli(0.5) assumption with a chi-square or runs test. If the bits show significant correlation or bias, the binomial FPR formula mis-states the true false positive rate, and the detection guarantee collapses.

Watch

Extended reading notes

Core claim

The thesis establishes that watermarking can be moved from a post-hoc add-on to the generative process itself. The signature method, Stable Signature, fine-tunes the decoder of a latent diffusion model for about a minute on fewer than 500 images so that every generated image—whether from text-to-image, inpainting, or editing—carries a chosen binary signature; a separately pre-trained HiDDeN-style extractor reads it back, and a binomial test on the number of matching bits decides detection or identification. The thesis further shows that the extracted bits from non-watermarked images can be made approximately i.i.d. Bernoulli(0.5) by a PCA-whitening layer appended to the extractor, which is what gives the claimed false positive rates. In audio, it introduces a localized zero-bit watermark that predicts presence at every time step, enabling fast detection of short cloned segments. For language models, it consolidates existing generation-time watermarks with statistically valid p-values, multi-bit payloads, and benchmark evaluations, and it demonstrates that watermarked text used for fine-tuning leaves a detectable trace in the fine-tuned model. Finally, it watermarks the weights of large transformers without training, by permuting and rescaling dimensions to create functionally equivalent but identifiable copies.

Load-bearing premise

The false positive guarantees rest on the assumption that, for non-watermarked content, the bits extracted by the decoder are independent and equally likely to be 0 or 1; if the whitening statistics learned on one image distribution fail to decorrelate bits on another distribution—or if an adversary crafts content with correlated bits—the claimed false positive rate no longer holds.

Editorial extensions

If this is right

  • A model provider can distribute open-weights diffusion models where every generated image is traceable to the specific model (or user), even after cropping to 10% of the original, at false positive rates below 10^{-6}.
  • Voice cloning detection can operate on short localized segments of audio, so a few seconds of cloned speech inside a longer recording can be flagged.
  • LLM watermarking can be used at scale with statistically valid p-values, and multi-bit messages allow attribution beyond binary AI/human detection.
  • If a language model is fine-tuned on watermarked text, the watermark survives into the fine-tuned model and can be detected with high significance even when only a small fraction of the training data is watermarked.
  • Transformer weights can be watermarked without retraining, so leaks of model copies can be traced back to the recipient.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A direct consequence the thesis leaves implicit: the same binomial machinery could be applied to any future modality (video, 3D meshes) as long as a fixed extractor and a whitening layer can be defined, so the framework is extensible rather than tied to the modalities tested.
  • The security analysis is not closed: an adversary who knows the extractor can attempt to estimate the whitening transform and craft content whose bits are correlated, which would break the FPR guarantee; testing robustness to such an adversary is a natural next step.
  • The i.i.d. assumption could be validated empirically per deployment: a platform could continuously monitor the extracted-bit statistics on its own content distribution and recalibrate the whitening layer when drift is detected.
  • The radioactive watermark result suggests a broader principle: any watermark embedded in training data acts as a tracer of model misuse, which could be extended to images and audio by fine-tuning on watermarked multimodal data.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. This PhD thesis compiles seven previously peer-reviewed contributions on watermarking images, audio, text, and model weights, organized around content moderation, tracing AI-generated content, and monitoring AI models. The main technical claims are that self-supervised latent spaces can host zero-bit and multi-bit watermarks with derived FPR bounds (Ch. 4), that imperceptible pre-release image modifications improve copy-detection indexing (Ch. 5), that fine-tuning the decoder of a latent diffusion model lets every generated image carry a detectable signature with a statistical test whose FPR is given by a binomial formula (Ch. 6), that localized audio watermarking detects cloned speech at the time-step level (Ch. 7), that LLM watermarking can be consolidated with exact p-value tests and multi-bit payloads (Ch. 8), that watermarks in fine-tuning data can be detected in downstream LLMs (Ch. 9), and that functionally equivalent weight permutations watermark large transformers (Ch. 10).

Significance. If the FPR claims held without qualification, the thesis would make watermarking substantially more actionable for content moderation and generative-model auditing. Strengths include the first-principles derivations of hypercone and binomial detection statistics, the use of standard datasets and evaluation protocols in most chapters, the release of code for the main methods, and the explicit discussion of limitations in several chapters. The main weakness is that several 'provable FPR' statements are conditional on empirical distributional assumptions (notably i.i.d. Bernoulli extracted bits) that are calibrated rather than proven; the practical significance is therefore real but more bounded than the text sometimes suggests.

major comments (3)
  1. [Ch. 6, Sec. 6.3.1, Eq. (6.2); Sec. 6.4.3] The claimed 'provable' false positive rate rests on the assumption that, under H0, the extracted bits are i.i.d. Bernoulli(1/2). The manuscript itself says 'We verify this assumption experimentally' (Sec. 6.3.1), and the only enforcement mechanism is a PCA whitening layer fitted to 10k COCO images (Sec. 6.4.3). Whitening makes continuous extractor outputs linearly uncorrelated and zero-mean on the calibration set; it does not make the hard-thresholded bits independent or unbiased for inputs outside that set. Since Eq. (6.2) is used to set detection thresholds and Eq. (6.3) to set identification thresholds, residual correlation or bias on a deployment distribution (screenshots, medical images, out-of-distribution content, or adversarially selected inputs) can make the effective FPR at a threshold nominally set to 1e-6 orders of magnitude larger. This is a calibration, not a proof. The authors should either provide a distribution-free bound, restrict the claim to empirically calibrated FPR on a specified distribution and add distribution-shift FPR measurements, or modify the extractor so the null distribution is exact by construction. The same issue propagates to the multi-bit variants in Chs. 4 and 7 that reuse binomial tests on extracted bits.
  2. [Ch. 4, Sec. 4.3.3, Eq. (4.4); Sec. 4.4.1] The zero-bit FPR formula in Eq. (4.4) is derived for a uniformly distributed feature vector on the hypersphere and a uniformly random key. The method whitens DINO features with a PCA fitted on 100k YFCC/COCO images (Sec. 4.4.1). Whitening enforces only the first two moments on the calibration corpus; it does not ensure uniformity, so Eq. (4.4) is not a theorem about arbitrary natural images. The sanity checks on 100k YFCC images and 1.28M ImageNet images are useful empirical evidence and should be presented as such. Please state the scope of the guarantee explicitly and report empirical FPR on at least one out-of-distribution corpus (e.g., heavily compressed images, text overlays, or images from a different domain).
  3. [Ch. 5, Sec. 5.6.1] The experimental evaluation of Active Image Indexing does not use the official DISC21 query set; the text says 'our queries are recreated transformations of images after active indexing' and 'most transformations of DISC21 were done manually so they are not reproducible.' This is a reasonable methodological choice, but it means the reported R@1 and µAP values are not directly comparable to published DISC21 results, and the main copy-detection claim is demonstrated only on a custom protocol. Please make this explicit in the contribution summary and, if possible, include a secondary evaluation on the official DISC21 queries or on a second benchmark to support the claim of improved copy detection.
minor comments (4)
  1. [Sec. 4.3.1, Sec. 2.2.4, Sec. 5.4.2] There are several typographical errors: 'valuemetric' should be 'value-metric', 'imperceptibility embedded' should be 'imperceptibly embedded', and 'watemarking' should be 'watermarking'.
  2. [Ch. 5, Table 5.2 and Sec. 5.6.1] The text should state more prominently that the query set is custom rather than the official DISC21 query set; the current phrasing can be misread as an evaluation on the official benchmark.
  3. [Sec. 3.1.5] The distinction between FPR as a global detector property and p-value as a local quantity is useful, but later chapters sometimes use 'FPR' for both concepts; a consistent naming convention would improve readability.
  4. [Ch. 6, Sec. 6.9.3] The empirical verification of the i.i.d. assumption should report the exact corpus, the number of images, and the test statistics used; the current statement only says the assumption was verified, without enough detail to assess the strength of the check.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: FPR claims are derived from stated statistical assumptions and empirical verification, not reduced to fitted inputs.

full rationale

The thesis's main quantitative claims are the FPR formulas (Eq. 4.4 and Eq. 6.2). These are derived from first principles: the hypercone volume for the zero-bit detector (proof in App. A.1) and the binomial c.d.f. under an explicitly stated i.i.d. Bernoulli assumption for extracted bits. The whitening step in Sec. 6.4.3 is a calibration to make that assumption plausible, and the thesis says 'We verify this assumption experimentally' (Sec. 6.9.3) rather than treating it as a theorem. This is an empirical validity check, not a circular reduction. Similarly, the per-chapter self-citations (e.g., 'Based on' headers, Furon 2019 for detector optimality) are transparent and not load-bearing: the FPR formulas stand on the included proofs, and the optimality remark is not used to derive any prediction. No 'prediction' in the available text is obtained by refitting a parameter to the target quantity. Distribution-shift concerns about the i.i.d. assumption are a correctness/robustness limitation, not circularity. Therefore no significant circularity is present.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

The central claims rely on statistical assumptions about natural data (i.i.d. bits) and on perceptual models as proxies for human vision; these are domain assumptions, not standard mathematical axioms. The methods also depend on hand-chosen hyperparameters and on whitening statistics fitted to calibration sets.

free parameters (4)
  • Whitening mean and covariance of watermark extractor outputs = Computed on 100k (Ch.4) or 10k (Ch.6) non-watermarked images
    Fitted to enforce i.i.d. Bernoulli bits under H0; the detection FPR formula relies on this calibration step.
  • Payload size k = 48 bits (Ch.6), 30 bits (Ch.4), 20 bits (Ch.5 comparison)
    Hand-chosen message length; affects robustness and detection thresholds.
  • Watermark strength alpha = 0.3 for HiDDeN extractor (Ch.6), 3 for active indexing (Ch.5)
    Hand-tuned scaling of the residual distortion; strongly affects reported TPR/FPR operating points.
  • Perceptual loss weight lambda_i = 0.2 (Ch.6), 1 (Ch.4)
    Chosen by hand; controls the imperceptibility-robustness trade-off in the reported results.
assumptions (3)
  • domain assumption Extracted bits from non-watermarked content are i.i.d. Bernoulli(0.5)
    Used to derive FPR formulas (Eq 6.2); enforced by whitening, not guaranteed by the extractor itself.
  • domain assumption Self-supervised and SSCD representations are invariant to the augmentation set used at marking time
    Central to Ch.4/Ch.5: if features are not stable under rotations/crops/blur, the embedded watermark or indexation push fails.
  • domain assumption Perceptual models (SSIM, JND, Watson-VGG) are adequate proxies for human visibility
    Used to shape perturbations; if these models under-estimate visibility, the 'imperceptible' claims overstate.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Watermarking across Modalities for Content Tracing and Generative AI." pith.science (2026). https://pith.science/paper/RCELGPZR

@misc{pith2026250205215,
  author       = {Pith},
  title        = {Pith review of: Watermarking across Modalities for Content Tracing and Generative AI},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RCELGPZR}},
  note         = {Machine review of arXiv:2502.05215}
}
read the original abstract

Watermarking embeds information into digital content like images, audio, or text, imperceptible to humans but robustly detectable by specific algorithms. This technology has important applications in many challenges of the industry such as content moderation, tracing AI-generated content, and monitoring the usage of AI models. The contributions of this thesis include the development of new watermarking techniques for images, audio, and text. We first introduce methods for active moderation of images on social platforms. We then develop specific techniques for AI-generated content. We specifically demonstrate methods to adapt latent generative models to embed watermarks in all generated content, identify watermarked sections in speech, and improve watermarking in large language models with tests that ensure low false positive rates. Furthermore, we explore the use of digital watermarking to detect model misuse, including the detection of watermarks in language models fine-tuned on watermarked text, and introduce training-free watermarks for the weights of large transformers. Through these contributions, the thesis provides effective solutions for the challenges posed by the increasing use of generative AI models and the need for model monitoring and content moderation. It finally examines the challenges and limitations of watermarking techniques and discuss potential future directions for research in this area.

Figures

Figures reproduced from arXiv: 2502.05215 by the authors.

Figure 1
Figure 1. – [PITH_FULL_IMAGE:figures/full_fig_p010_1.png] view at source ↗
Figure 1
Figure 1. – [PITH_FULL_IMAGE:figures/full_fig_p011_1.png] view at source ↗
Figure 1
Figure 1. – [PITH_FULL_IMAGE:figures/full_fig_p014_1.png] view at source ↗
Figures from the paper (69 more)
Figure 2
Figure 2. Figure 2: – [PITH_FULL_IMAGE:figures/full_fig_p026_2.png]
Figure 3
Figure 3. Figure 3: – [PITH_FULL_IMAGE:figures/full_fig_p032_3.png]
Figure 3
Figure 3. Figure 3: – [PITH_FULL_IMAGE:figures/full_fig_p033_3.png]
Figure 3
Figure 3. Figure 3: – [PITH_FULL_IMAGE:figures/full_fig_p038_3.png]
Figure 3
Figure 3. Figure 3: – [PITH_FULL_IMAGE:figures/full_fig_p041_3.png]
Figure 4
Figure 4. Figure 4: – [PITH_FULL_IMAGE:figures/full_fig_p046_4.png]
Figure 4
Figure 4. Figure 4: – [PITH_FULL_IMAGE:figures/full_fig_p049_4.png]
Figure 4
Figure 4. Figure 4 [PITH_FULL_IMAGE:figures/full_fig_p053_4.png]
Figure 4
Figure 4. Figure 4: – [PITH_FULL_IMAGE:figures/full_fig_p054_4.png]
Figure 4
Figure 4. Figure 4: – [PITH_FULL_IMAGE:figures/full_fig_p056_4.png]
Figure 4
Figure 4. Figure 4: – [PITH_FULL_IMAGE:figures/full_fig_p057_4.png]
Figure 5
Figure 5. Figure 5: – [PITH_FULL_IMAGE:figures/full_fig_p061_5.png]
Figure 5
Figure 5. Figure 5: – [PITH_FULL_IMAGE:figures/full_fig_p067_5.png]
Figure 5
Figure 5. Figure 5 [PITH_FULL_IMAGE:figures/full_fig_p068_5.png]
Figure 5
Figure 5. Figure 5: – [PITH_FULL_IMAGE:figures/full_fig_p069_5.png]
Figure 5
Figure 5. Figure 5 [PITH_FULL_IMAGE:figures/full_fig_p073_5.png]
Figure 5
Figure 5. Figure 5: – [PITH_FULL_IMAGE:figures/full_fig_p074_5.png]
Figure 5
Figure 5. Figure 5: – [PITH_FULL_IMAGE:figures/full_fig_p078_5.png]
Figure 5
Figure 5. Figure 5: – [PITH_FULL_IMAGE:figures/full_fig_p079_5.png]
Figure 5
Figure 5. Figure 5: – [PITH_FULL_IMAGE:figures/full_fig_p080_5.png]
Figure 6
Figure 6. Figure 6: – [PITH_FULL_IMAGE:figures/full_fig_p087_6.png]
Figure 6
Figure 6. Figure 6 [PITH_FULL_IMAGE:figures/full_fig_p090_6.png]
Figure 6
Figure 6. Figure 6: – [PITH_FULL_IMAGE:figures/full_fig_p092_6.png]
Figure 6
Figure 6. Figure 6 [PITH_FULL_IMAGE:figures/full_fig_p096_6.png]
Figure 6
Figure 6. Figure 6: – [PITH_FULL_IMAGE:figures/full_fig_p097_6.png]
Figure 6
Figure 6. Figure 6: – [PITH_FULL_IMAGE:figures/full_fig_p098_6.png]
Figure 6
Figure 6. Figure 6 [PITH_FULL_IMAGE:figures/full_fig_p099_6.png]
Figure 6
Figure 6. Figure 6: – [PITH_FULL_IMAGE:figures/full_fig_p100_6.png]
Figure 6
Figure 6. Figure 6: – [PITH_FULL_IMAGE:figures/full_fig_p101_6.png]
Figure 6
Figure 6. Figure 6: – [PITH_FULL_IMAGE:figures/full_fig_p102_6.png]
Figure 6
Figure 6. Figure 6: – [PITH_FULL_IMAGE:figures/full_fig_p103_6.png]
Figure 6
Figure 6. Figure 6: – [PITH_FULL_IMAGE:figures/full_fig_p104_6.png]
Figure 6
Figure 6. Figure 6: – [PITH_FULL_IMAGE:figures/full_fig_p107_6.png]
Figure 6
Figure 6. Figure 6: – [PITH_FULL_IMAGE:figures/full_fig_p109_6.png]
Figure 6
Figure 6. Figure 6: – [PITH_FULL_IMAGE:figures/full_fig_p111_6.png]
Figure 6
Figure 6. Figure 6: – [PITH_FULL_IMAGE:figures/full_fig_p112_6.png]
Figure 6
Figure 6. Figure 6 [PITH_FULL_IMAGE:figures/full_fig_p113_6.png]
Figure 7
Figure 7. Figure 7: – [PITH_FULL_IMAGE:figures/full_fig_p117_7.png]
Figure 7
Figure 7. Figure 7: – [PITH_FULL_IMAGE:figures/full_fig_p120_7.png]
Figure 7
Figure 7. Figure 7: – [PITH_FULL_IMAGE:figures/full_fig_p121_7.png]
Figure 7
Figure 7. Figure 7: – [PITH_FULL_IMAGE:figures/full_fig_p123_7.png]
Figure 7
Figure 7. Figure 7 [PITH_FULL_IMAGE:figures/full_fig_p127_7.png]
Figure 7
Figure 7. Figure 7 [PITH_FULL_IMAGE:figures/full_fig_p130_7.png]
Figure 7
Figure 7. Figure 7: – [PITH_FULL_IMAGE:figures/full_fig_p132_7.png]
Figure 7
Figure 7. Figure 7: – Watermark-removal attacks [PITH_FULL_IMAGE:figures/full_fig_p133_7.png]
Figure 7
Figure 7. Figure 7 [PITH_FULL_IMAGE:figures/full_fig_p134_7.png]
Figure 7
Figure 7. Figure 7: – [PITH_FULL_IMAGE:figures/full_fig_p135_7.png]
Figure 7
Figure 7. Figure 7: – [PITH_FULL_IMAGE:figures/full_fig_p139_7.png]
Figure 8
Figure 8. Figure 8: – [PITH_FULL_IMAGE:figures/full_fig_p145_8.png]
Figure 8
Figure 8. Figure 8: a [PITH_FULL_IMAGE:figures/full_fig_p146_8.png]
Figure 8
Figure 8. Figure 8: – [PITH_FULL_IMAGE:figures/full_fig_p147_8.png]
Figure 9
Figure 9. Figure 9: – [PITH_FULL_IMAGE:figures/full_fig_p157_9.png]
Figure 9
Figure 9. Figure 9 [PITH_FULL_IMAGE:figures/full_fig_p160_9.png]
Figure 9
Figure 9. Figure 9: – [PITH_FULL_IMAGE:figures/full_fig_p161_9.png]
Figure 9
Figure 9. Figure 9 [PITH_FULL_IMAGE:figures/full_fig_p162_9.png]
Figure 9
Figure 9. Figure 9: – [PITH_FULL_IMAGE:figures/full_fig_p163_9.png]
Figure 9
Figure 9. Figure 9 [PITH_FULL_IMAGE:figures/full_fig_p164_9.png]
Figure 9
Figure 9. Figure 9: – [PITH_FULL_IMAGE:figures/full_fig_p165_9.png]
Figure 9
Figure 9. Figure 9: – [PITH_FULL_IMAGE:figures/full_fig_p167_9.png]
Figure 9
Figure 9. Figure 9: – [PITH_FULL_IMAGE:figures/full_fig_p168_9.png]
Figure 9
Figure 9. Figure 9: – [PITH_FULL_IMAGE:figures/full_fig_p169_9.png]
Figure 9
Figure 9. Figure 9: – [PITH_FULL_IMAGE:figures/full_fig_p173_9.png]
Figure 9
Figure 9. Figure 9: – [PITH_FULL_IMAGE:figures/full_fig_p176_9.png]
Figure 9
Figure 9. Figure 9: b [PITH_FULL_IMAGE:figures/full_fig_p177_9.png]
Figure 9
Figure 9. Figure 9: – [PITH_FULL_IMAGE:figures/full_fig_p178_9.png]
Figure 9
Figure 9. Figure 9: – [PITH_FULL_IMAGE:figures/full_fig_p179_9.png]
Figure 10
Figure 10. Figure 10: – [PITH_FULL_IMAGE:figures/full_fig_p182_10.png]
Figure 10
Figure 10. Figure 10: – [PITH_FULL_IMAGE:figures/full_fig_p187_10.png]
Figure 10
Figure 10. Figure 10: – [PITH_FULL_IMAGE:figures/full_fig_p190_10.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

33 extracted references · 5 canonical work pages

  1. [7]

    Broken arrows

    50 Teddy Furon and Patrick Bas. Broken arrows. EURASIP Journal on Information Security, 2008:1–13, 2008. 26 Teddy Furon and Pierre Duhamel. An asymmetric public detection watermarking technique. In International Workshop on Information Hiding, pages 88–100. Springer, 1999. 198 Teddy Furon and Pierre Duhamel. An asymmetric watermarking method.IEEE Transact...

    arXiv 2008

  2. [9]

    Long short-term memory.Neural Computation MIT-Press, 1997

    20 S Hochreiter. Long short-term memory.Neural Computation MIT-Press, 1997. 18 Jordan Hoffmann, Sebastian Borgeaud, Arthur Mensch, Elena Buchatskaya, Trevor Cai, Eliza Rutherford, Diego de Las Casas, Lisa Anne Hendricks, Johannes Welbl, Aidan Clark, et al. Training compute-optimal large language models.arXiv preprint arXiv:2203.15556, 2022. 19 Ari Holtzma...

    arXiv 1997

  3. [11]

    Spoofing countermeasure based on analysis of linear prediction error

    24, 141 Artur Janicki. Spoofing countermeasure based on analysis of linear prediction error. InSixteenth annual conference of the international speech communication association, 2015. 23 Hervé Jégou and Ondřej Chum. Negative evidences and co-occurences in image retrieval: The benefit of pca and whitening. InECCV, 2012. 48 Herve Jegou, Matthijs Douze, and ...

    arXiv 2015

  4. [12]

    Ipcert:Provablyrobustintellectual property protection for machine learning

    67 ZhengyuanJiang,MinghongFang,andNeilZhenqiangGong. Ipcert:Provablyrobustintellectual property protection for machine learning. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 3612–3621, 2023a. 183 226 Zhengyuan Jiang, Jinghuai Zhang, and Neil Zhenqiang Gong. Evading watermark based de- tection of ai-generated content. I...

    arXiv 2023

  5. [13]

    Scaling laws for neural language models

    182 Jared Kaplan, Sam McCandlish, Tom Henighan, Tom B Brown, Benjamin Chess, Rewon Child, Scott Gray, Alec Radford, Jeffrey Wu, and Dario Amodei. Scaling laws for neural language models. arXiv preprint arXiv:2001.08361, 2020. 19, 183 Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. In Proc...

    arXiv 2001

  6. [14]

    Audiogen: Textually guided audio generation

    141 Felix Kreuk, Gabriel Synnaeve, Adam Polyak, Uriel Singer, Alexandre Défossez, Jade Copet, Devi Parikh, Yaniv Taigman, and Yossi Adi. Audiogen: Textually guided audio generation. arXiv preprint arXiv:2209.15352, 2022. 21 Felix Kreuk, Gabriel Synnaeve, Adam Polyak, Uriel Singer, Alexandre Défossez, Jade Copet, Devi Parikh, Yaniv Taigman, and Yossi Adi. ...

    arXiv 2022

  7. [16]

    Distortion ag- nostic deep watermarking

    20, 88 Xiyang Luo, Ruohan Zhan, Huiwen Chang, Feng Yang, and Peyman Milanfar. Distortion ag- nostic deep watermarking. InCVPR, 2020a. 26, 50, 56, 57 Yi Luo, Zhuo Chen, and Takuya Yoshioka. Dual-path rnn: efficient long sequence modeling for time-domain single-channel speech separation. InICASSP 2020-2020 IEEE International Conference on Acoustics, Speech ...

    arXiv 2020

  8. [17]

    The llama 3 herd of models.arXiv preprint arXiv:2407.21783, 2024

    19, 156, 163 Meta. The llama 3 herd of models.arXiv preprint arXiv:2407.21783, 2024. 19 Microsoft. Photodna. https://www.microsoft.com/en-us/photodna, 2009. 13, 60 Tomas Mikolov, Martin Karafiát, Lukas Burget, Jan Cernock` y, and Sanjeev Khudanpur. Re- current neural network based language model. InInterspeech, volume 2, pages 1045–1048. Makuhari, 2010. 1...

    arXiv 2024

Show all 33 references
  1. [18]

    Null-text inversion for editing real images using guided diffusion models.arXiv preprint arXiv:2211.09794, 2022

    23, 24, 141 Ron Mokady, Amir Hertz, Kfir Aberman, Yael Pritch, and Daniel Cohen-Or. Null-text inversion for editing real images using guided diffusion models.arXiv preprint arXiv:2211.09794, 2022. 20, 88 Subhabrata Mukherjee, Arindam Mitra, Ganesh Jawahar, Sahaj Agarwal, Hamid...

    2022 arXiv

  2. [19]

    Robust image watermarking in the spatial domain.Signal processing, 1998

    14 Nikos Nikolaidis and Ioannis Pitas. Robust image watermarking in the spatial domain.Signal processing, 1998. 26 Aude Oliva and Antonio Torralba. Modeling the shape of the scene: A holistic representation of the spatial envelope.International journal of computer vision, 42(3...

    1998

  3. [20]

    ChatGPT: Optimizing language models for dialogue., 2022

    183 OpenAI. ChatGPT: Optimizing language models for dialogue., 2022. 141 OpenAI. Introducing chatgpt, 2022. URL https://openai.com/index/chatgpt/ . Accessed: Jul. 29, 2024. 19 OpenAI. Gpt-4 technical report.arXiv, 2023. 19, 156, 181 OpenAI. Hello gpt-4o, 2024. URL https://open...

    2022 arXiv

  4. [21]

    Dct-based watermark recovering without resorting to the uncorrupted original image

    30, 172 Alessandro Piva, Mauro Barni, Franco Bartolini, and Vito Cappellini. Dct-based watermark recovering without resorting to the uncorrupted original image. InProceedings of international conference on image processing, volume 1, pages 520–523. IEEE, 1997. 26 Ed Pizzi, Sre...

    1997

  5. [22]

    Estimatingtrainingdata influence by tracing gradient descent.Advances in Neural Information Processing Systems, 33:19920–19930, 2020

    185 GarimaPruthi,FrederickLiu,SatyenKale,andMukundSundararajan. Estimatingtrainingdata influence by tracing gradient descent.Advances in Neural Information Processing Systems, 33:19920–19930, 2020. 199 Tong Qiao, Yuyan Ma, Ning Zheng, Hanzhou Wu, Yanli Chen, Ming Xu, and Xiang...

    2020 arXiv

  6. [23]

    Exploring the limits of transfer learning with a unified text-to-text transformer

    19 Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. Exploring the limits of transfer learning with a unified text-to-text transformer. Journal of machine learning research, 21(140):1–67, 2020. 22, 183,...

    2020 arXiv

  7. [24]

    Laion- 5b: An open large-scale dataset for training next generation image-text models.Advances in Neural Information Processing Systems, 35:25278–25294, 2022

    20 Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, MehdiCherti,TheoCoombes,AarushKatta,ClaytonMullis,MitchellWortsman,etal. Laion- 5b: An open large-scale dataset for training next generation image-text models.Advances in Neural Information Pro...

    2022 arXiv

  8. [25]

    Ai model gpt-3 (dis) informs us better than humans.Science Advances, 9(26):eadh1850, 2023

    94 242 Giovanni Spitale, Nikola Biller-Andorno, and Federico Germani. Ai model gpt-3 (dis) informs us better than humans.Science Advances, 9(26):eadh1850, 2023. 11, 14 Jianlin Su, Yu Lu, Shengfeng Pan, Ahmed Murtadha, Bo Wen, and Yunfeng Liu. Roformer: Enhanced transformer wit...

    2023 arXiv

  9. [26]

    Snr-constrained heuristics for optimizing the scaling parameter of robust audio watermarking.IEEE Trans

    185, 187, 189 Zhaopin Su, Guofu Zhang, Feng Yue, Lejie Chang, Jianguo Jiang, and Xin Yao. Snr-constrained heuristics for optimizing the scaling parameter of robust audio watermarking.IEEE Trans. Multim., 20(10):2631–2644, 2018. doi: 10.1109/TMM.2018.2812599. URL https://doi.or...

    2018

  10. [27]

    Optimal probabilistic fingerprint codes

    147, 156, 163, 189 Gábor Tardos. Optimal probabilistic fingerprint codes. Journal of the ACM (JACM), 55(2): 1–24, 2008. 109 International telecommunication Union. Algorithms to measure audio programme loudness and true-peak audio level.Series, BS, 2011. 121 BartThomee,DavidA.S...

    2008 arXiv

  11. [31]

    Lightfieldmessagingwithdeepphotographicsteganography

    29, 199 EricWengrowskiandKristinDana. Lightfieldmessagingwithdeepphotographicsteganography. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 1515–1524, 2019. 26 Wikipedia. Digital Millennium Copyright Act. https://en.wikipedia.org/w/in...

    2019

  12. [32]

    Unifying diffusion models’ latent space, with appli- cations to cyclediffusion and guidance.arXiv preprint arXiv:2210.05559, 2022

    108 Chen Henry Wu and Fernando De la Torre. Unifying diffusion models’ latent space, with appli- cations to cyclediffusion and guidance.arXiv preprint arXiv:2210.05559, 2022. 20, 88 Hanzhou Wu, Gen Liu, Yuwei Yao, and Xinpeng Zhang. Watermarking neural networks with watermarke...

    2022 arXiv

  13. [33]

    Large batch optimization for deep learning: Training bert in 76 minutes

    106 Yang You, Jing Li, Sashank Reddi, Jonathan Hseu, Sanjiv Kumar, Srinadh Bhojanapalli, Xiao- dan Song, James Demmel, Kurt Keutzer, and Cho-Jui Hsieh. Large batch optimization for deep learning: Training bert in 76 minutes. InICLR, 2020. 93 Chong Yu. Attention based data hidi...

    2020 arXiv

  14. [1993]

    On the importance of difficulty calibration in membership inference attacks.arXiv preprint arXiv:2111.08440, 2021

    67 Lauren Watson, Chuan Guo, Graham Cormode, and Alex Sablayrolles. On the importance of difficulty calibration in membership inference attacks.arXiv preprint arXiv:2111.08440, 2021. 158 Jason Wei, Maarten Bosma, Vincent Y Zhao, Kelvin Guu, Adams Wei Yu, Brian Lester, Nan Du, ...

    2021 arXiv

  15. [1994]

    Howkgpt: Investigating the detection of chatgpt-generated university student homework through context-aware perplexity analysis.arXiv preprint arXiv:2305.18226, 2023

    26 Christoforos Vasilatos, Manaar Alam, Talal Rahwan, Yasir Zaki, and Michail Maniatakos. Howkgpt: Investigating the detection of chatgpt-generated university student homework through context-aware perplexity analysis.arXiv preprint arXiv:2305.18226, 2023. 24 Ashish Vaswani, N...

    2023 arXiv

  16. [1996]

    Audiolm: A language modeling approach to audio generation.IEEE/ACM Transactions on Audio, Speech, and Language Processing, 31:2523–2533, 2022

    26 Zalán Borsos, Raphaël Marinier, Damien Vincent, Eugene Kharitonov, Olivier Pietquin, Matthew Sharifi, Dominik Roblek, Olivier Teboul, David Grangier, Marco Tagliasacchi, and Neil Zeghidour. Audiolm: A language modeling approach to audio generation.IEEE/ACM Transactions on A...

    2022 arXiv

  17. [1997]

    Deep residual learning for image recognition

    198 Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016a. 50 Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR. IEEE, 2016b. 72 Kaiming He, Haoqi Fan, Yuxi...

    2020 arXiv

  18. [2012]

    Are deep neural networks good for blind image watermarking? InWIFS, 2018

    62 Vedran Vukotić, Vivien Chappelier, and Teddy Furon. Are deep neural networks good for blind image watermarking? InWIFS, 2018. 26, 27, 46 Vedran Vukotić, Vivien Chappelier, and Teddy Furon. Are classification deep neural networks good for blind image watermarking?Entropy, 20...

    2018 arXiv

  19. [2013]

    Multidimensional binary search trees used for associative searching.Com- munications of the ACM, 18(9):509–517, 1975

    38 Jon Louis Bentley. Multidimensional binary search trees used for associative searching.Com- munications of the ACM, 18(9):509–517, 1975. 63 Amrita Bhattacharjee, Raha Moraffah, Joshua Garland, and Huan Liu. Eagle: A domain gener- alization framework for ai-generated text de...

    1975 arXiv

  20. [2015]

    Who wrote this code? watermarking for code generation.arXiv preprint arXiv:2305.15060, 2023

    11 Taehyun Lee, Seokhee Hong, Jaewoo Ahn, Ilgee Hong, Hwaran Lee, Sangdoo Yun, Jamin Shin, and Gunhee Kim. Who wrote this code? watermarking for code generation.arXiv preprint arXiv:2305.15060, 2023. 29, 172 Liangqi Lei, Keke Gai, Jing Yu, and Liehuang Zhu. Diffusetrace: A tra...

    2023 arXiv

  21. [2018]

    Stable signature is unstable: Removing image watermark from diffusion models.arXiv preprint arXiv:2405.07145, 2024

    30 225 Yuepeng Hu, Zhengyuan Jiang, Moyang Guo, and Neil Gong. Stable signature is unstable: Removing image watermark from diffusion models.arXiv preprint arXiv:2405.07145, 2024. 108, 196 Baihe Huang, Banghua Zhu, Hanlin Zhu, Jason D. Lee, Jiantao Jiao, and Michael I. Jordan. ...

    2024 arXiv

  22. [2019]

    Generative pretraining from pixels

    183 Mark Chen, Alec Radford, Rewon Child, Jeffrey Wu, Heewoo Jun, David Luan, and Ilya Sutskever. Generative pretraining from pixels. InInternational conference on machine learn- ing, pages 1691–1703. PMLR, 2020a. 20 Mark Chen et al. Evaluating large language models trained on...

    2021 arXiv

  23. [2021]

    The 2021 image similarity dataset and challenge.arXiv preprint arXiv:2106.09672, 2021a

    74 Matthijs Douze, Giorgos Tolias, Ed Pizzi, Zoë Papakipos, Lowik Chanussot, Filip Radenovic, Tomas Jenicek, Maxim Maximov, Laura Leal-Taixé, Ismail Elezi, et al. The 2021 image similarity dataset and challenge.arXiv preprint arXiv:2106.09672, 2021a. 22 Matthijs Douze, Giorgos...

    2021 arXiv

  24. [2022]

    21 Yogesh Balaji, Seungjun Nah, Xun Huang, Arash Vahdat, Jiaming Song, Karsten Kreis, Miika Aittala, Timo Aila, Samuli Laine, Bryan Catanzaro, et al

    URL https://proceedings.mlr.press/v162/bai22d.html. 21 Yogesh Balaji, Seungjun Nah, Xun Huang, Arash Vahdat, Jiaming Song, Karsten Kreis, Miika Aittala, Timo Aila, Samuli Laine, Bryan Catanzaro, et al. ediffi: Text-to-image diffusion models with an ensemble of expert denoisers...

    2022 arXiv

  25. [2023]

    break our steganographic system

    23 Patrick Bas, J-M Chassery, and Benoit Macq. Geometrically invariant watermarking using feature points. IEEE transactions on image Processing, 11(9):1014–1028, 2002. 26 Patrick Bas, Nicolas Le Bihan, and J-M Chassery. Color image watermarking using quaternion fourier transfo...

    2002 arXiv

Pith tools

Reviewed August 9, 2026 · model on record in the stance chip above.