Source-linked AI summary
Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust
Yuxin Wen, John Kirchenbauer, Jonas Geiping, Tom Goldstein
TL;DR
Diffusion-model outputs need watermarks that can identify machine-generated images while remaining invisible and robust to manipulation. The paper introduces Tree-Ring Watermarking, which alters the initial noise distribution, detects the embedded Fourier-space pattern by inversion, and reports negligible image-quality impact alongside robustness to common transformations. Its practical scope is bounded by DDIM inference, model-owner verification, and unresolved key capacity.
Problem
Diffusion-model outputs need invisible watermarks to identify machine-generated images and help mitigate potential harms.
Method
Tree-Ring Watermarking embeds a Fourier-space key in the initial noise array, generates images through the standard diffusion pipeline, and detects the key by inverting the model to recover that noise.
Results
The method provides per-sample-invisible watermarks designed to remain detectable under strong image manipulations, with negligible impact on image quality scores and applicability to diffusion models with or without text conditioning.
Takeaways & Limitations
Tree-Ring Watermarking offers a model-integrated approach that can be incorporated into existing diffusion-model APIs without additional training or finetuning.
Takeaways & Limitations
The method requires DDIM inference, is verifiable only by the model owner unless accessed through an API, and has unresolved capacity for multiple keys.
Abstract
from arXiv · showhide
Watermarking the outputs of generative models is a crucial technique for tracing copyright and preventing potential harm from AI-generated content. In this paper, we introduce a novel technique called Tree-Ring Watermarking that robustly fingerprints diffusion model outputs. Unlike existing methods that perform post-hoc modifications to images after sampling, Tree-Ring Watermarking subtly influences the entire sampling process, resulting in a model fingerprint that is invisible to humans. The watermark embeds a pattern into the initial noise vector used for sampling. These patterns are structured in Fourier space so that they are invariant to convolutions, crops, dilations, flips, and rotations. After image generation, the watermark signal is detected by inverting the diffusion process to retrieve the noise vector, which is then checked for the embedded signal. We demonstrate that this technique can be easily applied to arbitrary diffusion models, including text-conditioned Stable Diffusion, as a plug-in with negligible loss in FID. Our watermark is semantically hidden in the image space and is far more robust than watermarking alternatives that are currently deployed. Code is available at https://github.com/YuxinWenRick/tree-ring-watermark.
1 Introduction
Tree-Ring Watermarking addresses the need for invisible, detectable marks on diffusion-model outputs by altering generation rather than post-hoc image pixels. It embeds a pattern through the model’s noise process and is designed for practical integration and robustness to common image transformations.
- Motivation: Potential abuse of text-to-image models motivates invisible watermarks that identify machine-generated images and help organizations trace their origins.Such identification can support harm mitigation and cooperation with law enforcement.
- Prior approaches: Prior watermarking methods conceptualize the watermark as a minimal modification to an existing image, including Stable Diffusion’s deployed frequency-based watermark.The cited Stable Diffusion approach modifies a specific Fourier frequency in the generated image.
- Core idea: Tree-Ring Watermarking instead modifies the generated-image distribution without post-hoc image modifications, making the watermark invisible on a per-sample basis.The watermark appears as minor changes in possible scene layouts that humans cannot distinguish from random samples.
- Core idea: The method is based on patterns imprinted into the diffusion model’s initial-noise Fourier space and can be incorporated into existing diffusion-model APIs.Detection uses ring patterns in the Fourier space of the initial noise vector.
- Properties: Tree-Ring Watermarking is reported as more robust than existing methods against crops, color jitter, dilation, flips, rotations, and noise.The paper also evaluates image quality, false-positive rate, and use with diffusion models with or without text conditioning.
2 Related Work
Diffusion models generate images by iteratively denoising an initial noise map, while prior generative-model watermarking methods generally imprint signals post hoc or require training. The paper instead repurposes DDIM inversion to recover the initial noise underlying an image, enabling distributional watermark detection.
- Watermarking Digital Content: Prior image and generative-model watermarking approaches typically imprint learned or designed signals onto images, training data, model decoders, or generating models.The paper contrasts these post-hoc or training-based strategies with altering the output distribution directly.
- Fingerprinting and Watermarking Generative Models: Tree-Ring Watermarking alters the diffusion output distribution without post-hoc image modification or additional training, and is designed to work with existing models.The method is presented as a distributional watermark rather than a classical additive image signal.
- Diffusion Models: Diffusion models map an initial Gaussian noise vector to an image through deterministic DDIM denoising.The reverse process recursively applies a learned noise predictor from x_T to x_0.
- Diffusion Inversion: DDIM inversion estimates an initial noise vector from a generated image, with inversion reported to work for unconditional and conditional diffusion models even without conditioning information.The recovered vector approximately matches the original starting noise and is used by the watermarking method.
3 Method
Tree-Ring Watermarking embeds a structured key in the Fourier transform of the diffusion model’s initial noise, then detects it by inverting the generated image. Fourier-space patterns provide robustness to image transformations while preserving an approximately Gaussian noise distribution and enabling statistical detection.
- Overview of Tree-Ring Watermarking: Tree-Ring Watermarking selects an initial noise array whose Fourier transform contains a key, then generates the image with the standard diffusion pipeline.Detection inverts the image to estimate the initial noise and compares the Fourier coefficients in the masked region with the key.
- Key Design: A circular low-frequency mask defines the watermarked region, and key patterns are designed to preserve useful Fourier invariances while remaining statistically similar to Gaussian noise.The paper considers zero, random Gaussian, and ring-structured keys with different robustness and quality trade-offs.
- Statistical Detection: The detector declares an image watermarked when the key-matching statistic is sufficiently small, with a threshold calibrated to control false-positive behavior through a P-value.The statistical test assumes inverted noise from natural images is approximately Gaussian and uses a noncentral χ2 distribution.
- Fourier Invariances: Fourier-space construction links pixel-space transformations such as shifts, rotations, dilations, and color jitter to structured changes that the watermark can exploit.The paper reports that these invariances remain useful after applying image manipulations in pixel space.
- Key Design: Ring-structured keys use constant values along Fourier rings, making the watermark invariant to rotations while keeping the distribution close to an isotropic Gaussian.The ring values are sampled from a Gaussian distribution.
- Statistical Detection: Qualitative examples show non-watermarked, watermarked, and attacked images, with larger P-values for non-watermarked images and increased P-values after transformations.The captioned attacks include color jitter, Gaussian blur, Gaussian noise, and 180° rotation.
4 Experiments
Experiments evaluate Tree-Ring Watermarking on Stable Diffusion and an ImageNet diffusion model, measuring detectability, image quality, robustness, and hyperparameter sensitivity. The method remains detectable under adversarial image manipulations while preserving generation quality, with performance depending on watermark design and radius.
- Experimental Setting: Experiments use Stable Diffusion-v2 and a 256 × 256 ImageNet diffusion model, comparing Tree-Ring variants with DwtDct, DwtDctSvd, and RivaGAN.The evaluation reports watermark accuracy in benign and adversarial settings, alongside image-quality metrics including FID and, for Stable Diffusion, CLIP score.
- Benchmarking Watermark Accuracy and Image Quality: Tree-RingRand and Tree-RingRings are strongly detectable with negligible FID impact and no CLIP-score impact in the clean setting.These results are reported for the main experiments on Stable Diffusion and the ImageNet model.
- Benchmarking Watermark Robustness: Tree-Ring methods are more reliable than baselines under adversarial image manipulations, with Tree-RingRings performing best under adversarial conditions.Adversarial performance averages results over a battery of image manipulations.
- Benchmarking Watermark Robustness: Tree-RingZeros is robust against most perturbations except Gaussian noise and color jitter, while Tree-RingRand performs poorly under rotation despite robustness in most scenarios.Table 2 reports AUC for each attack setting on Stable Diffusion.
- Benchmarking Watermark Robustness: Tree-RingRings delivers the best average performance and supports multiple random keys without training, while remaining invisible in the image.The comparison notes that RivaGAN is also robust in most scenarios, but is not training-free or described as invisible in the same sense.
- Ablation Experiments: A watermark radius of 16 provides reasonably low FID while maintaining strong detection power, reflecting a trade-off between robustness and generation quality.Increasing the radius improves robustness but reduces generation quality.
5 Limitations and Future Work
The method remains constrained by its reliance on DDIM and the accuracy of inverse DDIM, while future work must address sampler compatibility and watermark-key capacity.
- Tree-Ring Watermarking requires DDIM during inference, so it would need adaptation if other sampling schemes replace DDIM.DDIM remains popular because of its economical GPU use and high quality.
- The watermark is currently verifiable only by the model owner because model parameters are needed for inversion.This limits third-party detection without relying on an API, although it prevents adversaries from verifying whether manipulations broke the watermark.
- The capacity for assigning unique keys to every API user is not yet clear.The paper explicitly leaves the feasibility of supporting many user-specific keys as an open question.
- Watermark effectiveness is directly related to the accuracy of the inverse DDIM process.Improving inversion accuracy or using invertible diffusion models could improve watermarking power.
6 Conclusion
The paper proposes watermarking diffusion outputs by minimally shifting their output distribution, making watermarks invisible per sample while preserving detectability under strong image manipulations.
- Minimal shifts of the diffusion model’s output distribution produce watermarks that are truly invisible on a per-sample basis.
- The approach optimizes the distribution shift so the watermark remains detectable after strong image manipulations encountered in everyday use.
A Appendix
The appendix documents evaluation settings and visual examples for watermark detection under attacks, including adversarial metrics and multiple augmentations.
- T@1%F denotes TPR@1%FPR, and Table 3 evaluates watermark accuracy in benign and adversarial settings.Adversarial performance averages results over a battery of image manipulations.
- Table 4 reports AUC for the ImageNet model under individual attacks to show Tree-RingRings’ effectiveness across augmentations.Cr. & Sc. refers to random cropping and rescaling.
- The appendix includes additional generated images produced with Tree-Ring Watermarking using the first seven MS-COCO-2017 training prompts.
- One figure evaluates results when k random attacks are applied simultaneously.