Pith. sign in

REVIEW 3 major objections 4 minor 39 references

Correlation-Aware and Gaussianity-Preserving Robust Latent Angular Watermarking for Diffusion Models

T0 review · 3 major / 4 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A watermark can be hidden in the angles of the diffusion latent while keeping every coordinate Gaussian.

desk verdict The paper's central claim of Gaussianity preservation is refuted by its own construction: paired encoding/reference vectors are exactly orthogonal, so a dot-product test detects LAW latents perfectly; the paper has useful analytic bits but needs major rework. read the letter →

arxiv 2607.22386 v1 pith:U2DSIH2D submitted 2026-07-24 cs.CV cs.CR

Yebin Zheng , Haonan An , Guang Hua , Zhiping Lin , Yuguang Fang This is my paper · ORCID
classification cs.CVcs.CR
keywords latentwatermarkingdiffusionmodelsGaussianitypreservationangularautocorrelationstructurei.i.d.degradationantipodalencodingmagnitude-drivensorting
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to show that a watermark can be embedded directly into the random latent noise of a diffusion model without breaking the Gaussian statistics that the generator expects. The method, LAW, splits the latent into disjoint pairs and encodes each watermark bit as the angular offset of one pair relative to a partner reference pair: ±π/2 for bit 0 or 1. The authors prove that every latent coordinate keeps zero mean and unit variance, that the induced correlations are confined to a sparse set of off-diagonal ±π/4 blocks, and that the decoding error under small perturbations scales as 1/ρ². If these claims hold, the method offers a keyless, high-capacity watermark that statistical tests cannot distinguish from clean noise and that survives common post-processing and regeneration attacks. A magnitude-driven variant, LAW-M, anchors bits in the largest-norm pairs for extra robustness at the cost of a per-image private key.

What carries the argument

The central object is the angular (phase) relation between two latent pairs: the encoding pair x_i and a reference pair r_i. The embedding rotates x_i so its phase is ϕ_{r,i} ± π/2, exploiting the rotation invariance of the isotropic Gaussian prior to preserve Gaussianity. The decoding rule is simply a phase comparison (Eq. 6). Two analytical results carry the argument: the closed-form autocorrelation block structure R = [[I_{2L}, A],[A^T, I_{2L}],[0,0,I]] with A_i = (1-2m_i)[[0, -π/4],[π/4, 0]] (Property 2), which characterizes the induced i.i.d. degradation; and var(Δφ) ≈ σ²/ρ² (Property 3), which justifies the magnitude-driven LAW-M variant that sorts pairs by norm.

What would settle it

Run LAW with all-zero message bits on a set of prompts, generate images with no attacks, invert them back to the latent, and measure the angular differences φ_x - φ_r across all bits. If a nontrivial fraction of bits falls within, say, 30° of the decision boundary at φ_x = φ_r (or if the empirical variance of Δφ exceeds the predicted σ²/ρ² by a large margin), the core decoding assumption fails. A complementary check: compare the inversion ℓ1 error for LAW-correlated latents against i.i.d. Gaussian latents; if the error gap is large enough to cross the ±π/2 decision margin, the robustness claim

Watch

Extended reading notes

Core claim

LAW embeds watermark bits as rotations in the latent prior: each bit is stored as the angle between an encoding pair and a reference pair, set to ±π/2 relative to the reference angle. Because an isotropic Gaussian is rotation-invariant, the marginal distribution of every coordinate remains standard normal. The paper derives the full autocorrelation matrix of the watermarked latent and proves it equals a block identity matrix plus sparse off-diagonal blocks of value ±π/4 coupling each encoding pair to its reference pair — a closed-form characterization of how much the i.i.d. condition is violated. It also proves that under isotropic Gaussian perturbation the angular error at decoding has vari

Load-bearing premise

The entire extraction pipeline assumes that inverting the diffusion process on the watermarked image recovers the latent pairs' phase difference closely enough to preserve the ±π/2 separation; the paper's own appendix shows inversion error grows when latent coordinates are correlated, and LAW is precisely what introduces such correlations.

Editorial extensions

If this is right

  • LAW provides a training-free, keyless (base variant) watermark that does not change the marginal Gaussianity of the latent prior, so model behaviour is minimally altered.
  • Because watermarked latents remain statistically indistinguishable from clean noise, classifiers trained to detect watermarks at image or latent level fail (accuracy stays near chance), blocking the usual first step of removal attacks.
  • The closed-form autocorrelation matrix lets a deployer predict and cap the i.i.d. violation introduced by watermarking, using watermark length L and message bits m rather than relying only on image-level FID.
  • LAW-M's magnitude anchoring gives a provable robustness advantage: choosing high-norm pairs lowers decoding angular-error variance ∝1/ρ², though it requires storing a per-image private key.
  • Capacity scales with the number of latent pairs: 512 bits in the experiments for LAW and 4096 for LAW-M without repeated embedding, avoiding the diversity loss of majority-vote schemes.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The angular-pair construction is not specific to diffusion latent priors; any generative model whose initial noise is isotropic Gaussian could in principle carry the same watermark, making the approach a general template for distribution-preserving latent watermarking.
  • The correlation analysis stops at second-order statistics; an editorial extension is to test whether the sparse ±π/4 cross-correlations create detectable higher-order dependencies after several denoising steps, which would tighten or weaken the indistinguishability claim.
  • Since bits are decoded from phase differences, combining angular encoding with error-correcting codes over the phase domain could push capacity beyond 4096 bits while retaining the Gaussianity guarantee.
  • The paper's own limitation (weakness against random drop) suggests a concrete testable fix: interleave or replicate encoding/reference pair assignments and re-derive the autocorrelation blocks to see whether the structured-correlation bound still holds.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes Latent Angular Watermarking (LAW) and a magnitude-driven variant LAW-M for diffusion models. Watermark bits are embedded by rotating disjoint latent pairs to ±π/2 relative to fixed reference pairs, with decoding via phase comparison after DDIM inversion. The authors claim the method preserves Gaussianity, induces only sparse, structured correlations (Property 2), gives angular-error variance inversely proportional to pair magnitude (Property 3), and achieves state-of-the-art robustness and fidelity. The paper includes closed-form derivations of the covariance structure and extensive experiments against post-processing and regeneration attacks.

Significance. If the Gaussianity-preservation and indistinguishability claims were correct, the method would be a notable advance: keyless, high-capacity, robust latent-domain watermarking with a rigorous correlation analysis. The covariance characterization in Property 2 is a useful analytic contribution, and the experimental comparison is reasonably thorough. However, the central claim is contradicted by the paper's own embedding equation: each encoding/reference pair is exactly orthogonal, giving a simple deterministic detector that separates watermarked from pristine latents. This invalidates the claimed Gaussianity preservation and computational indistinguishability, and therefore the significance of the method as presented is not established.

major comments (3)
  1. [§3.2.1, Eq. (14)] Eq. (14) implies x'_i · r_i = 0 identically for every encoding/reference pair. Substituting x'_i = [-(1-2m_i)ρ_x sin φ_r, (1-2m_i)ρ_x cos φ_r] and r_i = [ρ_r cos φ_r, ρ_r sin φ_r] gives cancellation. In a pristine i.i.d. Gaussian latent, the dot product of two independent pairs is a continuous random variable with variance 2, so it is exactly zero with probability 0. A detector that computes the dot product over the public partition and thresholds near zero will therefore separate LAW-watermarked latents from pristine ones with near-100% TPR at 0% FPR in the latent domain. This is a direct contradiction of the Gaussianity-preserving and computational-indistinguishability claims in the abstract, §1, and §4.2. Property 1 only proves zero mean and unit variance of the marginals, not joint Gaussianity; the watermarked distribution is supported on a submanifold of codimension L. The latent-le
  2. [Appendix F] The paper's own controlled experiment shows that introducing correlations into the initial latent increases the DDIM inversion ℓ1 error from 0.3304 to 0.9274. LAW's construction introduces both the covariance structure of Property 2 and the stronger exact-orthogonality constraint, yet no inversion-error or phase-preservation analysis is provided for LAW's own watermarked latents. Since decoding (Eq. 6) operates on phase differences between encoding and reference pairs estimated via DDIM inversion, the robustness results in Table 2 lack support for the no-attack and post-attack regimes until this inversion error is characterized.
  3. [Property 1 / Abstract] The terminology 'Gaussianity preservation' is overloaded. Property 1 (Appendix A.2) establishes only E[v'_j]=0 and Var(v'_j)=1 for each marginal; it does not establish that the vector v' is jointly Gaussian, and the appendix's own covariance computation plus the exact orthogonality constraint show it is not. The abstract and introduction nevertheless claim that the method 'preserving the Gaussianity' and that the latent remains 'statistically undetectable'. This is an overclaim that goes beyond the proven statement and is contradicted by the construction.
minor comments (4)
  1. [§2.2] Typo: 'watermark removal network is is trained' should be 'is trained'.
  2. [§3.2.1] Capitalization inconsistency: 'Law also requires' should be 'LAW also requires'.
  3. [Appendix A] Property numbering is inconsistent with the main text: Appendix A numbers Properties 1-6 differently from Properties 1-3 in §3.4. Please align numbering.
  4. [§4.2 / Figure 3] The description says classification is evaluated at both image and latent levels, but the figure appears to show only one panel; clarify which panel corresponds to which level and add the dot-product baseline discussed above.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: LAW's theoretical claims are direct consequences of its explicitly defined embedding rule, not fitted or self-citation-dependent.

full rationale

The paper's central derivation chain is self-contained. The embedding rule in Eq. (2) and its equivalent form in Eq. (14) define each watermarked encoding pair x'_i as a deterministic rotation of the original pair to ±π/2 relative to its reference pair r_i. Property 2's autocorrelation structure (Eqs. 9-10) is obtained by direct moment computation from this rule, using independence of the original Gaussian pairs; it is an analytic consequence of the construction rather than a prediction fitted to data. Property 3's angular-error variance (Eq. 11) is the standard small-angle approximation for isotropic perturbations and involves no fitted parameters. The paper does not fit a parameter to a subset and then predict a closely related quantity, nor does it define any central quantity in terms of its conclusion. The only author-overlapping citations ([3,4]) are used to motivate the existence of removal attacks and do not support any theorem or uniqueness claim; no load-bearing result is imported from prior self-citation. The possible concern that the exact orthogonality of the watermark is detectable is a correctness/security critique, not a circularity of the derivation. Accordingly, no circular step can be exhibited with the required specificity, and the circularity score is 0.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The method introduces no new physical or architectural entities. The key assumptions are the reliability of DDIM inversion, the Gaussian perturbation model for attacks, the (incorrect) claim that the angle reassignment preserves joint Gaussianity, and the security of a fixed public partition without a key. These assumptions are load-bearing for the theoretical and security claims.

assumptions (4)
  • domain assumption DDIM inversion with an empty prompt recovers the watermarked latent with sufficient accuracy for angular decoding
    Used in Sec. 3.2.2 and Algorithm 1; Appendix F shows inversion error grows when the latent is correlated (0.3304 → 0.9274), an effect not quantified for LAW's own latents.
  • domain assumption Latent perturbations during extraction are isotropic Gaussian noise with small σ relative to pair magnitude
    Property 3 and Appendix B; real post-processing and regeneration attacks are not isotropic Gaussian in the latent space, making the bound an idealized estimate.
  • ad hoc to paper Rotating (or re-angling) a pair of latent elements preserves the full joint Gaussianity of the latent vector
    Invoked in Sec. 3.2 and A.1; the operation in Eq. 14 is not a rotation but an angle reassignment that creates a lower-dimensional support, contradicting the claim of joint Gaussianity.
  • ad hoc to paper The fixed public partition into encoding/reference/non-encoding regions is secure against a keyless adversary
    Threat model (Sec. 3.1) assumes the adversary has no watermarking key, but LAW's partition is fixed and public, so an adversary can compute the dot products and remove the watermark by randomizing the identified encoding pairs.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Correlation-Aware and Gaussianity-Preserving Robust Latent Angular Watermarking for Diffusion Models." pith.science (2026). https://pith.science/paper/U2DSIH2D

@misc{pith2026260722386,
  author       = {Pith},
  title        = {Pith review of: Correlation-Aware and Gaussianity-Preserving Robust Latent Angular Watermarking for Diffusion Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/U2DSIH2D}},
  note         = {Machine review of arXiv:2607.22386}
}
abstract

Latent domain watermarking for diffusion models embeds watermarks directly into the latent prior, enjoying non-intrusiveness to model parameters and seamless integration with the generation process. However, due to the violation of latent Gaussianity or sensitivity to normal and malicious perturbations during latent inversion, existing methods are prone to watermark detection or removal attacks. A further overlooked problem is the violation of the i.i.d. latent condition after watermarking, which leads to latent correlation degradation and generation fidelity loss. Although this has been externally measured by FID, the internal correlation structure has yet to be rigorously characterized. To address the above issues, and motivated by the rotation-invariant property of isotropic Gaussian, we propose \textit{Latent Angular Watermarking (LAW)}, which encodes watermark bits as antipodal angles ($\pm\pi/2$ relative to a reference pair) between disjoint pairs of latent elements while preserving the Gaussianity. The antipodal ($\pi$-separation) encoding maximizes geometric separation between bit values, and we prove that the decoding angular-error variance is proportional to the norm of the latent pair, i.e., $\operatorname{var}(\Delta\phi) \propto 1/\rho^2$. We further propose a magnitude-driven variant, LAW-M, which anchors watermark bits in the most geometrically stable latent dimensions, yielding additional robustness gains. Theoretically, we provide a rigorous characterization of the induced correlation degradation, deriving in closed form the autocorrelation structure of the watermarked latent and proving that correlations are confined to a sparse, structured set of off-diagonal elements with fixed $\pm\pi/4$ values.

Figures

Figures reproduced from arXiv: 2607.22386 by the authors.

Figure 1
Figure 1. The embedding processes of LAW and LAW-M. Solid line: LAW. Dashed line: LAW-M. [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. The extraction processes of LAW and LAW [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Binary classification (watermark detection) accuracy and loss at image and latent levels. [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (6 more)
Figure 6
Figure 6. Figure 6: The results indicate that our method consistently achieves superior TPR and ACC. Notably, this performance gap becomes more pronounced as the distortion intensity increases. The performance disparity stems from the fun￾damental difference in encoding mechanisms. 7 [PI…
Figure 4
Figure 4. Figure 4: Qualitative comparison of image quality across various watermarking methods. [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 6
Figure 6. Figure 6: Comparison of PRC watermarking and our method under post-processing attacks. [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: Examples of 16 × 16 Autocorrelation matrices of PRC, Gaussian Shading, and LAW [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 8
Figure 8. Figure 8: Quantitative results of module ablation and parametric ablation, where LAW-M-D denotes [PITH_FULL_IMAGE:figures/full_fig_p009_8.png]
Figure 9
Figure 9. Figure 9: Qualitative comparison of image quality across various attack methods. [PITH_FULL_IMAGE:figures/full_fig_p021_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

39 extracted references · 2 canonical work pages

  1. [1]

    M, Archana Tampy.S, and Sasikumar M

    Navas K Aa, Ajay Mathews Cheriyan, Lekshmi. M, Archana Tampy.S, and Sasikumar M. Dwt-dct-svd based watermarking. IEEE, 6 2008. doi: 10.1109/COMSW A.2008.4554423

    arXiv 2008

  2. [2]

    Combined dwt-dct digital image watermarking.Journal of Computer Science, 3(9): 740–746, 2007

    Ali Al-Haj. Combined dwt-dct digital image watermarking.Journal of Computer Science, 3(9): 740–746, 2007

    2007

  3. [3]

    Removing box-free watermarks for image-to-image models via query- based reverse engineering

    Haonan An, Guang Hua, Hangcheng Cao, Zhengru Fang, Guowen Xu, Susanto Rahardja, and Yuguang Fang. Removing box-free watermarks for image-to-image models via query- based reverse engineering. InProceedings of the AAAI Conference on Artificial Intelligence, volume 40, pages 19615–19622, 2026

    2026

  4. [4]

    Box-free model watermarks are prone to black-box removal attacks.IEEE Transactions on Pattern Analysis and Machine Intelligence,

    Haonan An, Guang Hua, Zhiping Lin, and Yuguang Fang. Box-free model watermarks are prone to black-box removal attacks.IEEE Transactions on Pattern Analysis and Machine Intelligence,

  5. [5]

    Varia- tional image compression with a scale hyperprior

    Johannes Ballé, David Minnen, Saurabh Singh, Sung Jin Hwang, and Nick Johnston. Varia- tional image compression with a scale hyperprior. InInternational Conference on Learning Representations, 2018. URLhttps://openreview.net/forum?id=rkcQFMZRb

    2018

  6. [6]

    G. E. P. Box and Mervin E. Muller. A Note on the Generation of Random Normal Deviates. The Annals of Mathematical Statistics, 29(2):610 – 611, 1958. doi: 10.1214/aoms/1177706645. URLhttps://doi.org/10.1214/aoms/1177706645

    arXiv 1958

  7. [7]

    Trustmark: Robust watermarking and water- mark removal for arbitrary resolution images

    Tu Bui, Shruti Agarwal, and John Collomosse. Trustmark: Robust watermarking and water- mark removal for arbitrary resolution images. InProceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 18629–18639, October 2025

    2025

  8. [8]

    High-frequency matters: Attack and defense for image-processing model watermarking.IEEE Transactions on Services Computing, 17(4):1565–1579, 2024

    Huajie Chen, Tianqing Zhu, Chi Liu, Shui Yu, and Wanlei Zhou. High-frequency matters: Attack and defense for image-processing model watermarking.IEEE Transactions on Services Computing, 17(4):1565–1579, 2024. doi: 10.1109/TSC.2024.3349784

    arXiv 2024

Show all 39 references
  1. [9]

    Learned image compression with discretized gaussian mixture likelihoods and attention modules

    Zhengxue Cheng, Heming Sun, Masaru Takeuchi, and Jiro Katto. Learned image compression with discretized gaussian mixture likelihoods and attention modules. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2020

    2020

  2. [10]

    Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification

    Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification. In Aleš Leonardis, Elisa Ricci, Stefan Roth, Olga Russakovsky, Torsten Sattler, and Gül Varol, editors,Computer Vision – ECCV 2024, volume 15086 ...

    2024

  3. [11]

    Aqualora: toward white-box protection for customized stable diffusion models via watermark lora

    Weitao Feng, Wenbo Zhou, Jiyan He, Jie Zhang, Tianyi Wei, Guanlin Li, Tianwei Zhang, Weiming Zhang, and Nenghai Yu. Aqualora: toward white-box protection for customized stable diffusion models via watermark lora. InProceedings of the 41st International Conference on Machine Le...

    2024

  4. [12]

    The sta- ble signature: Rooting watermarks in latent diffusion models

    Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The sta- ble signature: Rooting watermarks in latent diffusion models. InProceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 22466–22477, October 2023

    2023

  5. [13]

    An undetectable watermark for generative image models

    Sam Gunn, Xuandong Zhao, and Dawn Song. An undetectable watermark for generative image models. InProceedings of the International Conference on Learning Representations (ICLR), 2025

    2025

  6. [14]

    Freqmark: Invisible image watermarking via frequency based optimization in latent space

    Yiyang Guo, Ruizhe Li, Mude Hui, Hanzhong Guo, Chen Zhang, Chuangjian Cai, Le Wan, and Shangfei Wang. Freqmark: Invisible image watermarking via frequency based optimization in latent space. In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang, ...

    2024 doi

  7. [15]

    Deep residual learning for im- age recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for im- age recognition. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), June 2016

    2016

  8. [16]

    Gans trained by a two time-scale update rule converge to a local nash equilibrium

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. InAdvances in Neural Information Processing Systems, volume 30, 2017

    2017

  9. [17]

    Spherical watermark: Encryption-free, lossless watermarking for diffusion models

    Xiaoxiao Hu, Jiaqi Jin, Sheng Li, Wanli Peng, Xinpeng Zhang, and Zhenxing Qian. Spherical watermark: Encryption-free, lossless watermarking for diffusion models. InThe Fourteenth International Conference on Learning Representations, 2026

    2026

  10. [18]

    ROBIN: Robust and invisible watermarks for diffusion models with adversarial optimization

    Huayang Huang, Yu Wu, and Qian Wang. ROBIN: Robust and invisible watermarks for diffusion models with adversarial optimization. InAdvances in Neural Information Processing Systems (NeurIPS), 2024

    2024

  11. [19]

    Semantic watermarking reinvented: Enhancing robustness and generation quality with fourier integrity

    Sung Ju Lee and Nam Ik Cho. Semantic watermarking reinvented: Enhancing robustness and generation quality with fourier integrity. InProceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 18759–18769, October 2025

    2025

  12. [20]

    Gaussmarker: Robust dual-domain watermark for diffusion models

    Kecen Li, Zhicong Huang, Xinwen Hou, and Cheng Hong. Gaussmarker: Robust dual-domain watermark for diffusion models. InProceedings of the 42nd International Conference on Machine Learning, 2025

    2025

  13. [21]

    Lawrence Zitnick

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C. Lawrence Zitnick. Microsoft coco: Common objects in context. InEuropean Conference on Computer Vision (ECCV), pages 740–755. Springer, 2014

    2014

  14. [22]

    Erase and repair: An efficient box-free removal attack on high-capacity deep hiding.IEEE Transactions on Information Forensics and Security, 18:5229–5242, 2023

    Hangcheng Liu, Tao Xiang, Shangwei Guo, Han Li, Tianwei Zhang, and Xiaofeng Liao. Erase and repair: An efficient box-free removal attack on high-capacity deep hiding.IEEE Transactions on Information Forensics and Security, 18:5229–5242, 2023. doi: 10.1109/TIFS. 2023.3305839

    2023

  15. [23]

    Dpm-solver++: Fast solver for guided sampling of diffusion probabilistic models.Machine Intelligence Re- search, 22:730–751, 2025

    Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm-solver++: Fast solver for guided sampling of diffusion probabilistic models.Machine Intelligence Re- search, 22:730–751, 2025

    2025

  16. [24]

    A watermark-conditioned diffusion model for ip protection

    Rui Min, Sen Li, Hongyang Chen, and Minhao Cheng. A watermark-conditioned diffusion model for ip protection. In Aleš Leonardis, Elisa Ricci, Stefan Roth, Olga Russakovsky, Torsten Sattler, and Gül Varol, editors,Computer Vision – ECCV 2024, pages 104–120, Cham, 2025. Springer ...

    2024

  17. [25]

    Learning transferable visual models from natural language supervision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. InInternational Conference on Machine Learning (ICM...

    2021

  18. [26]

    High- resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 10684–10695, June 2022

    2022

  19. [27]

    Rumelhart, Geoffrey E

    David E. Rumelhart, Geoffrey E. Hinton, and Ronald J. Williams. Learning representations by back-propagating errors.Nature, 323(6088):533–536, 1986. doi: 10.1038/323533a0

    1986 doi

  20. [28]

    Improved techniques for training gans

    Tim Salimans, Ian Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen. Improved techniques for training gans. InAdvances in Neural Information Processing Systems, volume 29, 2016

    2016

  21. [29]

    Denoising diffusion implicit models

    Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In International Conference on Learning Representations (ICLR), 2021

    2021

  22. [30]

    RAW: A robust and agile plug-and-play watermark framework for AI-generated images with provable guarantees

    Ganghua Wang, Xun Xian, Xuan Bi, Jayanth Srinivasa, Ashish Kundu, Jie Ding, and Mingyi Hong. RAW: A robust and agile plug-and-play watermark framework for AI-generated images with provable guarantees. InAdvances in Neural Information Processing Systems (NeurIPS), 2024

    2024

  23. [31]

    Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust

    Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust. InAdvances in Neural Information Processing Systems (NeurIPS), 2023

    2023

  24. [32]

    Gaussian shading: Provable performance-lossless image watermarking for diffusion models

    Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shading: Provable performance-lossless image watermarking for diffusion models. InProceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 12162–12171...

    2024

  25. [33]

    Deep model intellectual property protection via deep watermarking.IEEE Transactions on Pattern Analysis and Machine Intelligence, 44(8):4005–4020, 2022

    Jie Zhang, Dongdong Chen, Jing Liao, Weiming Zhang, Huamin Feng, Gang Hua, and Nenghai Yu. Deep model intellectual property protection via deep watermarking.IEEE Transactions on Pattern Analysis and Machine Intelligence, 44(8):4005–4020, 2022. doi: 10.1109/TPAMI.2021. 3064850

    2022 doi

  26. [34]

    Robust model watermarking for image processing networks via structure consistency.IEEE Transactions on Pattern Analysis and Machine Intelligence, 46(10): 6985–6992, 2024

    Jie Zhang, Dongdong Chen, Jing Liao, Zehua Ma, Han Fang, Weiming Zhang, Huamin Feng, Gang Hua, and Nenghai Yu. Robust model watermarking for image processing networks via structure consistency.IEEE Transactions on Pattern Analysis and Machine Intelligence, 46(10): 6985–6992, 2...

    2024

  27. [35]

    Robust invisible video watermarking with attention.ArXiv, abs/1909.01285, 2019

    Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention.ArXiv, abs/1909.01285, 2019. URL https: //api.semanticscholar.org/CorpusID:202540549

    1909 arXiv

  28. [36]

    Suppressing high-frequency artifacts for generative model watermarking by anti-aliasing

    Li Zhang, Yong Liu, Xinpeng Zhang, and Hanzhou Wu. Suppressing high-frequency artifacts for generative model watermarking by anti-aliasing. InProceedings of the ACM Workshop on Information Hiding and Multimedia Security, pages 223–234, 2024. doi: 10.1145/3658664. 3659634

    2024 doi

  29. [37]

    Invisible image watermarks are prov- ably removable using generative AI

    Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks are prov- ably removable using generative AI. InAdvances in Neural Information Processing Systems (NeurIPS), 2024

    2024

  30. [38]

    Hidden: Hiding data with deep networks

    Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. InProceedings of the European Conference on Computer Vision (ECCV), September 2018. 12 A Gaussianity Analysis We analyze the statistical properties of the watermarked latent zm i...

    2018

  31. [2026]

    doi: 10.1109/TPAMI.2026.3688047

    2026

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.