Source-linked AI summary
WaveMark: Robust Wavelet-Domain Image Watermarking for Diffusion Models
Jie Cao, Qi Li, Chaklam Cheong, Yutong Jin, Enze Yu, Zelin Zhang, Jianbing Ni
TL;DR
Watermark removal attacks can suppress embedded signals, complicating provenance verification. WaveMark embeds keyed, distributed replicas in diffusion initial noise using wavelet-domain projection magnitudes. On SD2.1, it reports 100.0% BA without attacks and over 88% BA under MarkNull attacks.
Problem
Removal attacks can suppress watermarks with little perceptual degradation, while reliable provenance verification matters for identifying and tracing AI-generated images.
Source: §1 · p. 1Method
WaveMark embeds keyed message replicas in wavelet-domain carriers in diffusion initial noise, using projection magnitudes to provide a decoding margin while preserving carrier energy in expectation.
Source: §1 · p. 1, §3.2 · p. 2, §3.3 · p. 3Results
Takeaways & Limitations
Experiments on SD3.5 support WaveMark’s applicability to a DiT architecture, and evaluated attack results provide a practical foundation for reliable watermark detection and user attribution.
Source: §5 · p. 4, §4.2 · p. 4Attribution assumes an authenticated association between each user account and its key-message pair.
Source: §2 · p. 2
Abstract
from arXiv · showhide
Image watermarking enables provenance tracing for photorealistic images generated by diffusion models. However, state-of-the-art (SOTA) removal attacks can suppress embedded signals with little perceptual degradation. This vulnerability limits the effectiveness of watermarks for intellectual property protection and misuse attribution. We propose WaveMark, a novel wavelet-domain watermarking method that embeds messages in a diffusion model's initial noise. To support robust recovery from perturbed carriers, WaveMark distributes keyed replicas of message bits across spatial positions, wavelet orientations, and scales. Each carrier groups coefficients from four latent channels and encodes a randomized bit through magnitude projection, providing an explicit decoding margin. We evaluate WaveMark with SD2.1 on SDP and MS-COCO Captions under 14 attacks. WaveMark achieves 100.0% bit accuracy (BA) without attacks, while maintaining image quality comparable to the evaluated baselines. Under SOTA MarkNull and MarkNull-A, it retains over 88% BA, outperforming all baselines.
1. INTRODUCTION
Removal attacks can suppress in-generation watermarks with little visible degradation, leaving provenance verification vulnerable. WaveMark addresses this with keyed wavelet-domain replicas and projection-magnitude embedding, reporting strong recovery under advanced attacks.
1. INTRODUCTION
- Watermarking supports identification, attribution, and source tracing as photorealistic images become easier to create and harder to verify as authentic.The passage notes risks including impersonation and misinformation, and identifies watermarking as a practical provenance signal [2].Source: §1 · p. 1
- Regeneration and adversarial attacks can suppress watermarks embedded during generation while causing little visible degradation, so robustness to common distortions alone is insufficient for provenance verification.The cited attack types include controllable diffusion regeneration, surrogate-model latent manipulation, and video-frame prediction,,.Source: §1 · p. 1
- Reliable recovery motivates three design questions: establishing a carrier-level margin, distributing replicas against correlated errors, and controlling carrier energy without sacrificing the encoded projection.The questions arise because correlated distortions can jointly defeat replicas, while repeated modifications can alter initial-noise energy and reduce image quality.Source: §1 · p. 1
- 100.0% BA without attacks and 88.66% and 88.06% under MarkNull and MarkNull-A, respectively, outperforming all baselines.WaveMark was evaluated under 14 attacks on SD2.1.Source: §1 · p. 1
- WaveMark distributes randomized, keyed bit replicas across disjoint four-channel carriers and uses projection-magnitude embedding to create a decoding margin while preserving carrier energy in expectation.The replicas span spatial positions, wavelet orientations, and scales.Source: §1 · p. 1
2. BACKGROUND
This section frames WaveMark as initial-noise watermarking and describes its user-attribution setting, generation and recovery pipeline, and thresholding assumptions.
2. BACKGROUND
- The attribution scenario assumes each user account is authentically associated with a key-message pair; extracting with the corresponding key and matching the registered message supports attribution.Source: §2 · p. 2
- Initial-noise watermarking embeds a watermark in the initial latent noise of a fixed latent diffusion model, using a secret key, binary message, and text prompt.Source: §2 · p. 2
- Embed constructs the watermarked initial noise, and Θ denotes the generative model; the embedding should preserve generation quality and consistency with prompt y.Source: §2 · p. 2
- Decoding estimates initial noise from a query image through approximate diffusion inversion, such as DDIM or DPM-Solver, before extracting the message with key K.Source: §2 · p. 2
- Verification accepts a query when recovered-message BA meets threshold τ, which is chosen for a target false-positive rate under an H0 model of independent, uniformly distributed extracted bits.Under that assumption, matches to an n-bit reference follow Binomial(n, 0.5), and τ is selected from its upper tail.Source: §2 · p. 2
3. METHODOLOGY
WaveMark embeds keyed, randomized message-bit replicas in four-channel carriers across wavelet subbands, then decodes them from an inverted image. Projection-magnitude embedding creates a carrier-level decision margin while scaling the orthogonal residual to preserve expected carrier energy.
3.1. Overview
- WaveMark repeats and key-randomizes message bits across wavelet subbands, embeds them in four-channel carriers, and reconstructs the watermarked noise for diffusion sampling.At decoding, it estimates initial noise by DDIM inversion, reproduces keyed carriers, thresholds projection magnitudes, reverses randomization, and uses hard majority voting.Source: §3.1 · p. 2
3.2. Message Bits and Keyed Wavelet Carriers
- Each message-bit replica receives a keyed subband and spatial position, and its carrier groups coefficients from the four latent channels at that position.The carriers are selected without replacement; the coarsest approximation, diagonal detail bands, and unselected coefficients remain unchanged.Source: §3.2 · p. 2
3.3. Projection-Magnitude Embedding
- Projection-magnitude embedding maps randomized bit zero to magnitude 0 and bit one to magnitude α, while scaling the orthogonal residual to preserve expected carrier energy.The residual-energy retention ratio δ trades retained residual energy against embedding strength and decision margin; WaveMark sets δ = 1/2.Source: §3.3 · p. 3
3.4. Watermark Decoding
- Decoding compares each recovered carrier’s projection magnitude with α/2, then combines replica votes using a fixed majority rule.The targets 0 and α place the threshold midway between them, giving both targets a margin of α/2; ties for even replica counts favor 1.Source: §3.4 · p. 3
4. EXPERIMENTS
Experiments evaluate WaveMark on SD2.1 across two prompt datasets, six watermarking baselines, and 14 attacks. It achieves the highest bit accuracy under MarkNull and MarkNull-A, maintains competitive image quality, and also recovers watermarks on SD3.5.
4.1. Experimental Setup
- Experiments generate 512 × 512 images with SD2.1 from SDP and MS-COCO Captions prompts, using 50 DDIM denoising steps.The setup generates 100 watermarked images per in-generation method.Source: §4.1 · p. 3
- The comparison includes six watermarking baselines and five common distortions, regeneration attacks, adversarial attacks, and the SOTA MarkNull and MarkNull-A attacks.Each attack is applied to 100 generated watermarked images per watermarking method, following configurations from the original attack papers.Source: §4.1 · p. 3
- Watermark performance is measured by BA, while image-generation quality is assessed with CLIP-Score, CLIP-IQA, and FID.Table 1 covers watermark performance and image quality; Table 2 reports BA under various attacks.Source: §4.1 · p. 3, Table 1 · p. 4, Table 2 · p. 4
4.2. Experimental Results
- 100.0% BA on both datasets, with the highest CLIP-IQA on SDP and second-highest on MS-COCO Captions.WaveMark’s image quality is reported as competitive while achieving full BA; Table 1 covers watermark performance and image quality on both datasets.Source: §4.2 · p. 4, Table 1 · p. 4
- 98.84% to 100.0% BA under common distortions, including 99.75% under 50% random cropping and 99.81% under contrast adjustment.Under regeneration attacks, BA is 98.25% for DA and 96.72% for VA, compared with 79.47% for CtrlRegen+ and 54.18% for NFPA.Source: §4.2 · p. 4
- 88.66% and 88.06% BA under MarkNull and MarkNull-A, respectively, with improvements of 27.30% and 13.32% over the strongest baselines.Table 2 compares BA across attacks; these are WaveMark’s reported results for the two SOTA removal attacks.Source: §4.2 · p. 4, Table 2 · p. 4
- Except for NFPA, WaveMark’s BA remains above the 71.875% detection threshold under all evaluated attacks.The reported NFPA attack predicts a video successor from the watermarked image and produces images substantially different from the original inputs.Source: §4.2 · p. 4
- On SD3.5, WaveMark achieves 99.81% and 100.0% BA on SDP and MS-COCO Captions, supporting compatibility with both U-Net and DiT architectures.The SD3.5 results also report CLIP scores of 28.963 and 26.513, CLIP-IQA scores of 0.937 and 0.922, and FID values of 81.079 and 205.881, respectively.Source: §4.2 · p. 4
5. CONCLUSION
WaveMark embeds keyed message replicas in initial noise using wavelet subbands and projection magnitudes. On SD2.1 it reaches 100.0% BA without attacks and retains 88% BA under MarkNull and MarkNull-A, while SD3.5 experiments support applicability to a DiT architecture.
5. CONCLUSION
- WaveMark embeds messages in LDM initial noise and distributes keyed replicas across wavelet subbands, encoding each replica in a carrier’s projection magnitude.The conclusion reports 100.0% BA without attacks and 88% BA under MarkNull and MarkNull-A, outperforming all baselines.Source: §5 · p. 4
- SD3.5 experiments support WaveMark’s applicability to a DiT architecture for watermark embedding.Future work will extend WaveMark toward public verification without disclosing users’ secret keys.Source: §5 · p. 4