PaperlayerView exact revision on arXiv

Source-linked AI summary

RingID: Rethinking Tree-Ring Watermarking for Enhanced Multi-Key Identification

Hai Ci, Pei Yang, Yiren Song, Mike Zheng Shou

arXiv:2404.14055v3cs.CV

TL;DR

Tree-Ring’s ability to identify multiple keys remained unclear despite its strong watermark verification and the importance of source tracing. RingID combines heterogeneous watermark types across channels with further imprinting and rotation enhancements. Verification AUC improves from 0.975 to 0.995, while identification accuracy rises from 0.07 to 0.82.

  • Problem

    Although Tree-Ring has strong verification performance, its ability to distinguish multiple keys for source tracing and user attribution remained unclear.

    Source: §1 · p. 2

  • Method

    RingID combines different watermark types across multiple channels with discretization, lossless imprinting, and rotation-specific design enhancements.

    Source: §1 · p. 3

  • Results

    Verification AUC improves from 0.975 to 0.995, while identification accuracy rises from 0.07 to 0.82.

    Source: §1 · p. 3

  • Takeaways & Limitations

    Distribution shift contributes to Tree-Ring’s verification robustness but cannot help identify keys because different watermarks experience the same shift.

    Source: §1 · p. 2

    Under multi-key identification, both Tree-Ring and RingID remain vulnerable to cropping and scaling attacks.

    Source: §7 · p. 14

Abstract

from arXiv · show

We revisit Tree-Ring Watermarking, a recent diffusion model watermarking method that demonstrates great robustness to various attacks. We conduct an in-depth study on it and reveal that the distribution shift unintentionally introduced by the watermarking process, apart from watermark pattern matching, contributes to its exceptional robustness. Our investigation further exposes inherent flaws in its original design, particularly in its ability to identify multiple distinct keys, where distribution shift offers no assistance. Based on these findings and analysis, we present RingID for enhanced multi-key identification. It consists of a novel multi-channel heterogeneous watermarking approach designed to seamlessly amalgamate distinctive advantages from diverse watermarks. Coupled with a series of suggested enhancements, RingID exhibits substantial advancements in multi-key identification. Github Page: https://github.com/showlab/RingID

1 Introduction

Tree-Ring’s verification robustness partly comes from an unintended distribution shift, but that shift cannot distinguish different keys. RingID combines heterogeneous multi-channel watermarking with additional enhancements to improve verification and identification.

1 Introduction

  • Identifying AI-generated images matters for detecting fabrication and tracking and protecting copyrights.The introduction identifies watermarking as a reliable solution.Source: §1 · p. 1
  • Tree-Ring’s robustness partly stems from distribution shift during imprinting, which especially helps against rotation and crop/scale transformations but does not distinguish keys.Different watermarks experience the same shift.Source: §1 · p. 2
  • Tree-Ring struggles to distinguish dozens of keys because its patterns lack discrimination and its imprinting process produces broken watermarks.Identification accuracy under rotation and crop/scale attacks is close to zero.Source: §1 · p. 2
  • RingID combines multi-channel heterogeneous watermarking with discretization and lossless imprinting; rotation identification accuracy rises from nearly 0 to 0.86.The paper also proposes systematic fixes to Tree-Ring’s rotation design.Source: §1 · pp. 2–3
  • Verification AUC improves from 0.975 to 0.995, while identification accuracy rises from 0.07 to 0.82.The paper reports these gains for RingID.Source: §1 · p. 3

2 Related Work

The related work places RingID within diffusion-model research and content watermarking, distinguishing its focus on identifying multiple keys from prior Tree-Ring verification work.

2.1 Diffusion Models

  • Diffusion models learn to recover clean data from gradually added Gaussian noise and are used to generate high-resolution images and model diverse data types.The passage mentions applications including video, audio, 3D objects, and humans.Source: §2.1 · p. 3

2.2 Watermarking Diffusion Models

  • Diffusion watermarking can protect model weights or generated content; RingID builds on Tree-Ring while targeting its vulnerability to identifying multiple keys.Tree-Ring imprints a pattern into initial diffusion noise and has demonstrated robustness to varied attacks.Source: §2.2 · p. 3

3 Preliminaries

The preliminaries define a threat model for watermarking generated images, establish the paper’s diffusion-noise notation, and distinguish verification from multi-key identification.

3.1 Threat Model

  • The model owner embeds imperceptible watermarks in generated images for copyright protection and source tracking, while an attacker applies transformations to evade checks.The stated goal is high verification and identification accuracy regardless of image transformations.Source: §3.1 · p. 4

3.2 Notation

  • The paper denotes initial diffusion noise by x_T and its frequency counterpart after FFT by X_T.It also defines real, imaginary, and conjugate-symmetric components and identifies the watermarked channels and keys.Source: §3.2 · p. 4

3.3 Task Formulation: Verification vs. Identification

  • Verification distinguishes watermarked from unwatermarked images by distance to a reference key, whereas identification selects the closest key from a distributed set.Identification can attribute each generated image to a unique user when users receive different keys.Source: §3.3 · p. 4

4 Delve into Tree-Ring Watermarking

The section revisits why Tree-Ring withstands image transformations, evaluates multi-key identification, and diagnoses vulnerabilities under rotation and crop/scale.

4.1 Recap of Tree-Ring

  • Tree-Ring embeds a Gaussian-sampled ring pattern in frequency-transformed initial noise; detection inverts diffusion and compares recovered-pattern ℓ1 distances to the reference.Source: §4.1 · p. 5

4.2 Distribution Shift in Watermarking

  • Discarding the imaginary part shifts watermarked ℓ1 distances lower, aiding verification; it helps under Rotation and Crop/Scale but cannot distinguish keys.The paper also reports that an operation causing sufficient distribution shift can work as a standalone watermarking approach.Source: §4.2 · p. 6, Effect in Different Tasks and Attacks · p. 7

4.3 Is Tree-Ring Good at Identification?

  • Tree-Ring struggles to identify as few as 32 keys, with accuracy nearly zero under Rotation and Crop/Scale attacks.The analysis attributes poor identification more broadly to insufficiently distinguishing patterns, including in clean settings.Source: §4.3 · p. 7

4.4 Why is Tree-Ring Vulnerable to Rotation and Crop/Scale?

  • Crop/scale disrupts frequency-domain rings; rotation vulnerability reflects corner cropping, lossy imprinting, and rotationally asymmetric ring shape.Scaling compresses the frequency spectrum, while cropping modulates frequency magnitudes.Source: §4.4 · p. 7

5 RingID: Enhanced Watermarking for Identification

RingID extends Tree-Ring with a multi-channel heterogeneous framework and targeted design changes for multi-key identification. Its design combines watermark types while adjusting rotation robustness, distinguishability, and capacity.

5.1 Multi-Channel Heterogeneous Watermarking

  • MCH imprints different watermark types on separate noise channels and identifies the key by the minimum normalized channel-wise ℓ1 distance.The proposed combination uses Gaussian noise and tree-ring watermarks, whose advantages are complementary.Source: §5.1 · p. 8

5.2 Being Invariant to Rotation

5.3 Discretization for Enhanced Distinguishability

  • Restricting each ring to ±α replaces random Gaussian values, boosting valid distinguishability; setting α to the initial-noise standard deviation limits generation-quality impact.Source: §5.3 · p. 10

5.4 Increasing Capacity

  • 2|R| keys are available by adding rings in one channel, though excessive rings reduce robustness and quality; multi-channel capacity scales as n|c| but risks central artifacts.Source: §5.4 · pp. 10–11

6 Experiment

RingID substantially outperforms Tree-Ring in multi-key identification, including at 2048 keys, while retaining comparable generation quality. The experiments also examine component trade-offs, ring placement, performance as key counts grow, and qualitative image changes.

6.1 Experimental Setup

  • RingID uses StableDiffusion-V2, evaluates verification with ROC-AUC and identification across key counts, and tests JPEG, rotation, crop-and-scale, blur, noise, and brightness distortions.Generation quality is assessed with CLIP alignment and FID; generation and inversion use 50 steps.Source: §6.1 · p. 11

6.2 Comparison with Baselines

  • With 2048 keys, RingID’s identification accuracy is 0.942 versus Tree-Ring’s 0.077; with 32 keys, their average accuracy excluding C&S is 0.992 versus 0.465.The comparison reports accuracy across distortions and different key counts.Source: §6.2 · p. 11, Table 2 · p. 12
  • Under C&S distortion, both Tree-Ring and RingID achieve average verification AUC higher than 0.97; both methods have similar CLIP scores (0.364 vs. 0.365), and FIDs are 25.93 (Tree-Ring) and 26.13 (RingID).In identification, both methods struggle with C&S distortion.Source: §6.2 · p. 11

6.3 Ablation Study

  • Rounder rings raise accuracy from 0.620 to 0.860, while spatial shift improves rotation robustness at the expense of robustness to blur and brightness.The ablation reports that spatial shift, lossless imprinting, and discretization significantly contribute to rotation robustness.Source: §6.3 · p. 12, Table 3 · p. 13

6.4 Discussion

  • Among single-channel noise-watermark placements, channel 0 performs best; channels 0 and 1 together perform best overall, while using all three channels lowers accuracy from 0.830 to 0.807.The comparison varies which channels receive the noise watermark.Source: §6.3 · p. 12, Table 4 · p. 13
  • With 12 rings fixed, distributing them across more channels reduces performance and increases artifact frequency, so the authors recommend placing them on one channel.The discussion reports the performance trend in Table 5 and artifacts in Appendix C.Source: §6.4 · p. 12, Table 5 · p. 14
  • For 11 rings with capacity 2048, radii 3–14 are a good choice; the optimal radius varies with the number of rings.Source: §6.4 · p. 13, Table 6 · p. 13
  • RingID maintains good accuracy as key counts grow, although accuracy decreases linearly as the number of keys increases exponentially.Figure 5 plots average identification accuracy against key count.Source: §6.4 · p. 13, Figure 5 · p. 14

7 Conclusion and Limitation

The appendix traces how Tree-Ring’s imaginary-part removal shifts watermark statistics, while the conclusion notes that both Tree-Ring and RingID remain vulnerable to cropping and scaling.

7 Conclusion and Limitation

  • Both Tree-Ring and RingID remain vulnerable to cropping and scaling; exploring other transform domains is left for future work.Source: §7 · p. 14

A Distribution Shift in Watermarking

A.1 Preliminaries

  • The preliminaries distinguish spatial- and frequency-domain notation and note that real spatial signals have conjugate-symmetric frequency counterparts.Source: §A.1 · p. 19

A.2 Tree-Ring’s Pipeline

  • Tree-Ring inserts a watermark by replacing masked frequency-domain noise values, then retains only the real spatial-domain signal for diffusion denoising.Source: §A.2 · pp. 19–20

A.3 Distribution Shift in Watermarked Region

  • Discarding the imaginary part changes the distribution of watermarked frequency pixels, while leaving non-watermarked pixels unchanged.Source: §A.3 · pp. 20–21

A.4 From Energy’s Viewpoint

  • Discarding the imaginary part reduces the watermarked region’s energy by half.Source: §A.4 · p. 21

A.5 Distribution Shift in ℓ1 Distance

Under simplified distributional assumptions, imaginary-part removal reduces the expected ℓ1 distance to the reference; in practice, pattern matching and distribution shift both contribute.

A.5 Distribution Shift in ℓ1 Distance

  • The derivation assumes recovered watermark samples follow the injected distribution, whereas practical fixed patterns create correlations and combine pattern matching with distribution shift.Source: §A.5 · pp. 21, 23
  • The unshifted recovered and null watermarks each have expected normalized ℓ1 distance N√(π/2) from the reference.Source: §A.5 · p. 22
  • The expected ℓ1 distance after imaginary-part removal is √3/2 times the corresponding unshifted expectation.Source: §A.5 · p. 23

A.6 Distribution Shift in Real Scenarios

Control experiments find that removing distribution shift lowers verification performance, especially under rotation and crop-and-scale attacks, where the shifted distance distributions overlap more.

A.6 Distribution Shift in Real Scenarios

  • Control 1 follows Tree-Ring’s original setup, while Control 2 shifts the null watermark to match the imprinting shift.Source: §A.6 · p. 23
  • Average AUC falls from 0.975 to 0.913 when distribution shift is removed, with the major drop under Rotation and Crop & Scale attacks.Source: §A.6 · p. 23, Table 7 · p. 24
  • Without distribution shift, null-watermark distances are closer, especially under Rotation and C&S, indicating overlap consistent with lower AUC.Source: §A.6 · p. 23

B Discarding Imaginary Part As Standalone Watermarking Approach

The appendix tests imaginary-part discarding as a standalone watermarking approach using per-image random noise; its verification performance is close to Tree-Ringrand’s.

B Discarding Imaginary Part As Standalone Watermarking Approach

C Failure Cases of Multi-Channel Rings

RingID uses a single ring-watermark channel by default because multi-channel ring imprinting can produce ring-like artifacts. Across different diffusion models, its identification accuracy improves from older to newer Stable Diffusion versions.

C Failure Cases of Multi-Channel Rings

D.1 Results on Different Diffusion Models

  • RingID’s identification accuracy improves from older to newer Stable Diffusion versions, with results reported across different diffusion models.Table 10 reports identification accuracy on those models.Source: §D.1 · p. 26, Table 10 · p. 26

D.2 Comparison with More Methods

RingID achieves the best AUC and TPR@1%FPR among the compared methods under both clean and adversarial verification settings. Additional qualitative results show images generated with SD 2.1 using Stable-Diffusion-Prompts.

D.2 Comparison with More Methods

  • RingID achieves the best AUC and TPR@1%FPR among compared methods under both clean and adversarial verification settings.Table 11 presents the comparison.Source: §D.2 · p. 26
  • The additional method comparison concerns watermark verification.Source: §D.2 · p. 26

E More Qualitatives

Loading 2404.14055v3…