An Undetectable Watermark for Generative Image Models

1 INTRODUCTION

• PRC selects initial latent noise for diffusion generation; its pseudorandom pattern is distributed across latent space, and error correction supports robustness and message encoding.The detector is more robust than the decoder, which can still be useful when message decoding fails.Source: §1 · p. 2
• Users can set message length and a desired false-positive upper bound when generating keys, without additional training or fine-tuning.The paper states that the false-positive rate is rigorously proved not to exceed the chosen bound.Source: §1 · p. 2
• FID, CLIP, and Inception Score are preserved by PRC, unlike every other watermarking scheme tested.The authors state that undetectability theoretically ensures quality preservation and frame the experiments as checking security with finite parameters.Source: §1 · p. 2
• LPIPS-measured perceptual variability is preserved under PRC, unlike every other comparable scheme tested.Source: §1 · p. 2
• An image classifier fails to learn to detect PRC, while the same classifier quickly learns every other tested scheme.Source: §1 · p. 2
• Watermark removal attacks fail without significantly degrading image quality, and PRC is most robust among the three tested schemes with the lowest quality impact.The evaluation covers ten attack types and compares PRC with eight state-of-the-art schemes.Source: §1 · p. 2
• The watermark supports robust encoding of 512-bit messages and at least 2500 bits for images that are not attacked.The decoder's robustness is comparable to, though slightly below, the detector's for 512-bit messages.Source: §1 · p. 3

2 RELATED WORK

• Post-processing embeds watermarks after generation, while in-processing modifies the model or sampling process; PRC is in-processing.Source: §2 · p. 3
• Post-processing watermarks cannot be undetectable without extra modeling assumptions, because fixed images can be distinguished from their modified versions.Source: §2 · p. 3
• Tree-Ring fixes Fourier-domain latent rings to zero and detects them using DDIM inversion, but its latent distribution shift reduces quality and variability.It is zero-bit and susceptible to a surrogate attack that removes the watermark with minimal image-quality impact.Source: §2 · p. 3
• Gaussian Shading restricts latents to a fixed quadrant; its single-image distribution guarantee does not ensure quality under metrics that capture correlations across generations.The authors report degraded FID and Inception Score, alongside higher LPIPS similarity and diminished variability.Source: §2 · pp. 3–4

3.1 THREAT MODEL

• Removal attackers are assumed weaker than the provider and must preserve image quality; spoofing receives limited experiments, though the authors state their techniques yield provable resilience with unforgeable public attribution.The authors do not discuss spoofing adversary capabilities in detail.Source: §3.1 · p. 4

3.2 OVERVIEW OF THE PRC WATERMARK

• Watermarked images are generated by conditioning Gaussian latent signs on a PRC codeword, then passing the resulting latent and prompt to the image generator.The sampling algorithm multiplies each codeword sign by the absolute value of a Gaussian coordinate.Source: §3.2 · p. 6
• The scheme is undetectable against polynomial-time adversaries when the underlying PRC is pseudorandom, but the experimental parameter choices are not suitable for undetectability-critical use.The authors note that their experiments do not strictly follow the parameter bounds required by the pseudorandomness proof.Source: §3.2 · p. 6
• Detection recovers an approximation of the original latent and checks its signs for the PRC pattern; decoding can recover messages but is slower and less robust than detection.Detection depends on Recover producing a sufficiently accurate latent approximation.Source: §3.2 · pp. 5–6
• The figure contrasts post-processing watermarks that directly perturb an un-watermarked image, with StegaStamp producing visible blur.Source: Figure 1 · p. 7
• Images generated independently of the watermarking key have at most probability F of being identified as watermarked by the detector or decoder.The user selects the desired false-positive bound F when generating the key.Source: §3.2 · pp. 6–7

4.1 EXPERIMENT SETUP

• Experiments used Stable Diffusion latent diffusion and compared PRC with in- and post-processing baselines across MS-COCO and Stable Diffusion Prompt datasets.Evaluation covered effectiveness, image quality, robustness, and detectability; quality and variability were assessed using FID, CLIP, Inception Score, and LPIPS.Source: §4.1 · pp. 7–8, §4.2 · p. 8

4.2 QUALITY AND DETECTABILITY

• PRC was the only method to consistently preserve image quality across three metrics on both datasets, and its perceptual variability was comparable to un-watermarked images.The variability comparison excluded post-processing methods; PRC outperformed the other in-processing schemes on this measure.Source: §4.2 · pp. 8–9
• A ResNet18 classifier reached only 50% validation accuracy on PRC, while validation detection was perfect for every other tested scheme.For PRC, training convergence alongside chance-level validation accuracy indicated memorization rather than learning the watermark pattern.Source: §4.2 · p. 9, Figure 2 · p. 9

4.3 ROBUSTNESS OF THE DETECTOR

• No tested method reduced PRC’s TPR below 0.99 while keeping FID under 70; JPEG quality 20 lowered TPR from 1.0 to 0.94 but visibly blurred images.The study tested nine watermarking techniques against ten attack types; t = 2 improved robustness but was not explored further because fast attacks on undetectability exist for that choice.Source: §4.3 · p. 9

4.4 ENCODING LONG MESSAGES IN THE WATERMARK

• PRC reliably decoded 512-bit messages and recovered up to 2500 bits when images faced no watermark-removal attacks.For 512-bit messages, decoder robustness was slightly below detector robustness.Source: §4.4 · p. 9

4.5 SECURITY OF THE PRC WATERMARK UNDER SPOOFING ATTACKS

• The tested spoofing attack cannot work against an undetectable watermark such as PRC.The attack used a PGD-based method to make a surrogate classifier label un-watermarked images as watermarked.Source: §4.5 · p. 10

4.6 POSSIBILITY OF EXTENSION

• PRC was demonstrated on traditional VAE models, while applying it to flow-matching models depends on a suitable Recover algorithm.Source: §4.6 · p. 10

• The approach encodes long messages without observable shifts in the generated image distribution, while achieving robustness competitive with state-of-the-art schemes that incur large observable shifts.Source: §5 · p. 10

• Under the embedding attack, only PRC attained FID below a threshold; above it, StegaStamp was strongest, although the attack assumes knowledge of the diffusion model’s VAE.An adversarially robust VAE encoder or keeping the VAE private could mitigate the attack; strength-2 embedding still left PRC detection above 95% while visibly degrading image quality.Source: Figure 8 · p. 15, Figure 12 · p. 17
• For 512-bit messages, the detector is faster and consistently more robust than the decoder, which must recover the embedded message.Source: Figure 10 · p. 16
• The spoofing attack raises false-positive rates for Tree-Ring and StegaStamp, but does not affect the undetectable PRC watermark.Source: Figure 11 · p. 16
• The Gaussian Shading example places the flower in the same location across generated images, and the long-message figure tests decoding without adversarial perturbations using t = 4, F = 1e-9, and σ = 0.Source: Figure 13 · p. 18, Figure 14 · p. 18

• Photometric attacks varied brightness enhancement factors from 2 to 12 and contrast factors from 2 to 7; degradation attacks varied blur radius, Gaussian noise, and JPEG quality.JPEG quality ranged from 10 to 60, with lower quality causing greater degradation; blur radii ranged from 2 to 12 and noise standard deviations from 5 to 30.Source: §A.2 · p. 19
• Regeneration attacks added noise and denoised images using either diffusion-model or VAE-based approaches.The diffusion attack used Stable-Diffusion-2-1base for 10 to 200 steps; VAE attacks used two CompressAI models with compression factors from 1 to 6.Source: §A.2 · p. 19
• Adversarial attacks targeted surrogate detectors or image embeddings, using PGD to perturb images within an l∞ limit.Surrogate attacks used a ResNet18 trained for 10 epochs and tested multiple watermark methods at epsilon values of 4, 8, and 12; the embedding attack assumed knowledge of the diffusion model’s VAE.Source: §A.2 · p. 19

B THE PSEUDORANDOM CODE

• The PRC code embeds random parity checks in codewords and is constructed under the stated subexponential-hardness assumption for LPN.The paper notes that later PRC constructions use different assumptions, but whether they improve watermark robustness remains open.Source: B THE PSEUDORANDOM CODE · p. 20

C.1 DESIGNING THE WATERMARK DETECTOR

• The detector accepts soft decisions by taking a vector of estimated bit values in [−1, 1], rather than a recovered bit string.Its design estimates parity-check satisfaction probabilities from the recovered latent, then thresholds them using a false-positive bound.Source: B THE PSEUDORANDOM CODE · p. 20, §C.1 · pp. 22, 24

B THE PSEUDORANDOM CODE

• Message decoding uses belief propagation with ordered statistics decoding instead of increasing the PRC block length, but requires Recover to approximate the initial latent accurately.The authors report decoder function under significant perturbation in their robustness experiments with sparsity t = 3.Source: B THE PSEUDORANDOM CODE · p. 21
• The block length n is the dimension of the image latents; increasing it improves robustness, while increasing message length reduces robustness.Larger parity-check sparsity t strengthens undetectability against more powerful adversaries but decreases robustness; the false-positive bound is at most F when the tested string is independent of the key.Source: B THE PSEUDORANDOM CODE · p. 21

C DETAILS ON THE PRC WATERMARK

• Watermarked images are generated by choosing initial-latent signs according to a PRC codeword, with any message first encoded into that code.The detector and decoder allow an estimated error σ; users may set σ = 0 when image perturbation robustness is unnecessary.Source: B THE PSEUDORANDOM CODE · pp. 21–22, C DETAILS ON THE PRC WATERMARK · p. 22

C.2 BOUNDING THE FALSE POSITIVE RATE: PROOF OF THEOREM 2

• The proof uses a bounded-above version of Hoeffding’s inequality to bound the detector’s false-positive rate.It treats parity-check contributions as independent, uniformly random values by the construction of the parity-check matrix and the uniformly random one-time pad.Source: §C.2 · pp. 24–25
• The detector’s testbits ensure a false-positive rate of at most F, and Theorem 2 extends that bound to the PRC detector and decoder.The theorem passage states its claim for any input string s in [−1, 1]^n.Source: §C.2 · p. 24

C.3 PRACTICAL UNDETECTABILITY

• For the experimental parameters, undetectability is not guaranteed against motivated adversaries, although the scheme is asymptotically undetectable under the stated assumptions and parameter scaling.The authors characterize it as sufficiently undetectable for main practical applications based on their experiments.Source: §C.3 · p. 25
• A brute-force attack finds a used t-sparse parity check in O(nt−1) time, with model queries counted as O(1).The authors did not optimize this attack, so faster attacks may exist.Source: §C.3 · p. 25
• Most robustness experiments use t = 3, while t = 7 is identified as a better choice for cryptographic undetectability on n = 2^14-dimensional latents.The detector still works at t = 7 on non-perturbed images, but the authors choose t = 3 for improved robustness.Source: §C.3 · p. 25
• The authors attribute the relatively fast distinguishing attack to quasi-polynomial-time attacks against the underlying PRCs and identify PRCs without such attacks as an open question.They state that such a PRC could yield a watermark with improved undetectability through their transformation.Source: §C.3 · p. 26

D DEMO: PRC WATERMARK FOR VAES

• Over 90% TPR is achieved for a zero-bit PRC watermark on a CelebA-trained VAE with a 256-dimensional latent space, t = 2, and FPR = 0.05.Detection uses latent optimization with the gradient-descent technique of Hong et al. (2023); the authors did not investigate VAE robustness or quality in depth.Source: D DEMO: PRC WATERMARK FOR VAES · p. 26