CLUE-MARK: Watermarking Diffusion Models using CLWE

Aashish Kolluri; Kareem Shehata; Prateek Saxena

REVIEW 4 major objections 5 minor 46 references

CLUE-MARK: Watermarking Diffusion Models using CLWE

T0 review · 4 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read CLUE-Mark embeds a secret signal in diffusion latent noise and proves that detecting it without the key is as hard as solving the decision hCLWE problem.

desk verdict The CLWE-for-watermarking idea is fresh and the paper is well-written, but the provable undetectability claim breaks at Algorithm 1: the sampler does not actually output hCLWE samples at the deployed parameters. read the letter →

arxiv 2411.11434 v4 pith:S6R3HULJ submitted 2024-11-18 cs.CR

Kareem Shehata , Aashish Kolluri , Prateek Saxena This is my paper · ORCID

classification cs.CR

keywords watermarkingdiffusionmodelsCLWEhundetectabilitysteganographylattice-basedcryptographylatentspace

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

CLUE-Mark aims to stamp diffusion-model images with a secret signal that no efficient detector without the key can distinguish from an ordinary generated image. The watermark lives in the latent noise vector: instead of drawing the initial latents from a standard Gaussian, the scheme blocks them and draws each block from the homogeneous Continuous Learning With Errors (hCLWE) distribution, which is Gaussian in every direction except one secret direction where it is periodically concentrated. The paper proves that any efficient distinguisher between marked and unmarked images would solve the decision hCLWE problem, so under the hCLWE assumption the watermark is undetectable and cannot degrade output quality. A verifier holding the key inverts the diffusion process, projects the estimated latents onto the secret direction, and runs a Rayleigh test on the wrapped scores to recover the signal. If the construction holds, a provider can watermark an unmodified diffusion model and verify images without any per-image nonce or prompt.

What carries the argument

The load-bearing object is the homogeneous Continuous Learning With Errors (hCLWE) distribution $H_{w,\beta,\gamma}$, whose density is a standard Gaussian in every direction except the secret unit direction $w$, where it is periodically concentrated into 'pancakes' of spacing about $1/\gamma$ and width about $\beta/\gamma$. CLUE-Mark blocks the diffusion latent vector into $n$-dimensional chunks, transforms them with the inverse discrete wavelet transform, and uses them as the initial latents; recovery inverts the diffusion model, projects the estimated latents onto $w$ to form $z_i = \gamma \langle y_i, w \rangle \bmod 1$, and feeds the wrapped scores to the Rayleigh test. The proof connects the detectable pattern to CLWE hardness, and Algorithm 1 is the practical sampler that attempts to produce $H$ exactly by rounding the projection to the nearest lattice point and adding Gaussian noise in the secret direction.

What would settle it

Draw many samples from Algorithm 1 with $\gamma=2$, $\beta=0.001$, compute $z=\gamma'\langle y,w\rangle\bmod 1$, and compare the empirical mass on integer bins with the rounded Gaussian's prediction: the paper's Claim 2.1 gives $P(1)/P(0)=\exp(-\pi/\gamma'^2)\approx 0.456$ for $\gamma'\approx 2$, whereas direct rounding of a Gaussian gives about $0.885$. A statistically significant mismatch would show the sampler is not producing the hCLWE distribution, severing the reduction between the implemented watermark and CLWE hardness.

Watch

Extended reading notes

Core claim

The paper's central claim is Theorem 2: under the hCLWE hardness assumption for $n$ dimensions with parameters $\gamma$ and $\beta$, the CLUE-Mark scheme with latent vectors of dimension $mn$ (with $m$ polynomial in $n$) is undetectable in the sense of Definition 2.6. The proof is a reduction: a distinguisher that tells watermarked images from normal ones can be turned into a distinguisher for the decision hCLWE problem by assembling each queried image's latent vector from oracle samples and running the rest of the generation pipeline unchanged. The practical counterpart is that with $\gamma=2$, $\beta=0.001$ and 32-dimensional blocks in the DWT domain, the recovered signal separates marked from unmarked images with AUC above 0.99 on both datasets, image quality measured by FID is essentially unchanged, and the mark survives JPEG compression and brightness adjustment while resisting the steganalysis attack that defeats Tree Ring and Gaussian Shading.

Load-bearing premise

The load-bearing premise is that Algorithm 1 exactly samples the hCLWE distribution, because the undetectability proof feeds those samples to the generator as if they were oracle draws from that distribution.

Editorial extensions

If this is right

A model provider can watermark outputs without retraining, fine-tuning, or changing model weights, because only the input noise vector is modified.
Under the hCLWE assumption, no efficient adversary without the key can distinguish marked from unmarked images, so marked images behave identically to ordinary outputs for every downstream use.
The scheme supports multiple keys, so a provider can assign a different key per user and trace which account generated a given image.
CLUE-Mark is deliberately not perfectly robust: it survives mild JPEG compression and brightness shifts but fails under cropping and rotation, consistent with the paper's impossibility theorem for undetectable robust watermarks.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

An external reader should note that Claim 2.1's sampler is not proven to output exactly hCLWE: for $\gamma'\approx 2$ the rounded-Gaussian bin ratio is about $0.885$, not $\exp(-\pi/4)\approx 0.456$, so a direct statistical test of Algorithm 1 would determine whether the implemented watermark is the distribution the reduction covers.
The paper itself states that its concrete parameters ($\gamma=2$, $\beta=0.001$) come from an empirical covariance attack, not from the theoretical CLWE reductions; the formal theorem is therefore conditional on the hCLWE assumption holding at those values.
If the latent-blocking recipe transfers, the same construction could watermark other generative models that consume Gaussian noise, such as GANs or DDIM-style samplers, whenever the initial latent can be recovered by inversion.
Since the keyed detector is a Rayleigh test on wrapped projections, deployment can tune the p-value threshold to set the false-positive rate, which is the operating point for platforms that want to avoid flagging unmarked images.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Here's my read on CLUE-Mark. The core idea—using hCLWE to bias diffusion latents and reduce undetectability to the CLWE assumption—is new, and the paper is a clear, honest piece of work. The reduction in Theorem 2 is fine in the abstract: if you had an oracle returning exact hCLWE samples, undetectability would follow from hCLWE hardness. The problem is that Algorithm 1 is not such an oracle. Claim 2.1's proof replaces the actual probability that k = round(γ' ) with the continuous weight ρ_{γ'}(k) = exp(-π k^2/γ'^2). That's not the probability; the probability is the integral of a Gaussian over the rounding interval. At the deployed parameters γ=2, β=0.001, so γ'≈2, the ratio P(k=1)/P(k=0) is about 0.885, not the required exp(-π/4)≈0.456. The adjacent pancakes are misweighted by nearly a factor of two. So the output is not H_{w,β,γ}, and Theorem 2 has nothing to say about the images the paper actually produces.

The paper's own Section 5.1 already concedes that the concrete parameters are empirical, not reduction-backed. That concession becomes load-bearing once the sampler is off.

The empirical study is useful, though limited: 100 prompts, no error bars, AUC >0.99 for recovery, FID much closer to unwatermarked than Tree Ring or Gaussian Shading, and the steganalysis attack doesn't remove the watermark. The robustness to JPEG and brightness is real but modest. Those are secondary.

Who should read it: people working on watermarking or provenance for generative models. The CLWE angle is worth taking seriously, and the sampler bug is exactly the kind of subtle gap that careful refereeing should catch. The paper is salvageable: either fix the sampler so it really draws from hCLWE (e.g., correct rounded-Gaussian weights or rejection sampling), or reframe the claims as empirical with the provable part as an open problem.

My recommendation: send it to peer review. The idea deserves time, but the reviewers should be told to focus on the sampler and on whether the security claim can be made to match the implementation.

Referee Report

4 major / 5 minor

Summary. The paper proposes CLUE-Mark, a watermarking scheme for diffusion-model images based on the continuous learning with errors (hCLWE) distribution. The latent noise vector of a diffusion model is replaced, blockwise, by samples that are claimed to come from the hCLWE distribution; the watermark is recovered by inverting the diffusion process and applying a keyed statistical test. The main theoretical contribution is Theorem 2, a reduction showing that if the decision hCLWE problem is hard, then no efficient adversary without the key can distinguish watermarked from unwatermarked images. The paper also reports empirical evaluations of recovery accuracy, image quality, robustness to JPEG/brightness changes, and resistance to a specific steganographic attack, with a proof-of-concept implementation made available.

Significance. The idea of basing a diffusion-model watermark on a lattice-derived continuous distribution is novel and potentially useful: if the reduction were tight and the sampler exact, CLUE-Mark would be the first watermarking scheme with undetectability reduced to a cryptographic hardness assumption, and the paper provides a clear formal framework (Definitions 2.2–2.6) for reasoning about such schemes. The paper also honestly identifies the impossibility of simultaneously achieving completeness, soundness, undetectability, and perfect robustness (Appendix A). However, the central claim is currently not established for the implemented system: the proof of Claim 2.1 does not show that Algorithm 1 samples the hCLWE distribution, and the concrete parameters used in the evaluation are explicitly outside the regime covered by known CLWE hardness reductions. The reduction template in Theorem 2 is a useful contribution, but the gap between the oracle-based theorem and the deployed sampler is load-bearing.

major comments (4)

[§4.3, Claim 2.1 and Algorithm 1] The proof of Claim 2.1 is incorrect: it substitutes the continuous weight ρ_{γ′}(k) = exp(−πk²/γ′²) for the actual probability that k = round(γ′⟨y,w⟩) is selected. For input y drawn from the standard normal used by diffusion models, the correct probability is P_k = Φ((k+1/2)/γ′) − Φ((k−1/2)/γ′). At the deployed parameters γ = 2, β = 0.001 (so γ′≈2), P_1/P_0 ≈ 0.885, whereas Definition 4.1 requires the k-th pancake weight to be proportional to exp(−πk²/γ′²), giving exp(−π/4) ≈ 0.456 for k=0 versus k=1. Consequently Algorithm 1 does not sample H_{w,β,γ}; successive pancakes are misweighted by nearly a factor of two. Since Theorem 2's reduction assumes oracle samples from H_{w,β,γ}, the undetectability guarantee does not apply to the implemented CLUE-Mark pipeline. The algebra in Appendix B proves that a different algorithm—one that samples k directly with weight ρ_{γ′}(k)—would produce H_{w,β,γ}, but that is not what Algorithm 1 does.
[§5.1, RQ1 parameter selection] The parameters actually deployed (n=32, γ=2, β=0.001, m≤512) are chosen from the empirical covariance-attack experiments in Figure 8, and Section 5.1 states explicitly that these parameters are 'based on our empirical evaluations and not on the theoretical reductions of CLWE hardness'. Known CLWE hardness results require γ = Ω(√n), which for n=32 means γ≥5.66, so the security of the deployed parameters is not supported by Theorem 1. Moreover, the empirical attack experiments in Section 5.1 evaluate Algorithm 1's samples, not the hCLWE distribution H_{w,β,γ} of Definition 4.1; because the sampler is not exact, those experiments cannot validate the hardness assumption needed by Theorem 2 for the implemented scheme. The paper should either use parameters in the known-hard regime, or clearly reframe the security claim as conditional on a new, nonstandard hardness assumption for the sampled distribution.
[§4.2, Theorem 2 proof] The reduction does not account for the effect of the inverse discrete wavelet transform on the secret direction. In the implemented scheme, hCLWE samples are created in the frequency domain and the latent vector is z = IDWT(y). If the DWT is orthogonal, z is distributed as H_{U^T w, β, γ}, not H_{w, β, γ}, where U is the DWT matrix. The proof never specifies that the key used by the watermark distinguisher must be U^T w (or, equivalently, that the key in the security experiment is the transformed direction). As written, the marked distribution in the reduction is not the one defined by the CLUE-Mark key w. This is fixable, but it is a genuine gap in the formal statement. Additionally, the theorem bounds m (samples per image) but not the number q of images queried by the distinguisher; the hCLWE assumption should be stated for the total number of oracle samples, which is mq.
[§4.3, Algorithm 1 and Definition 4.1] There is also a variance-convention mismatch. Algorithm 1 draws z_i ← N(0,β), which under the standard reading gives a Gaussian with standard deviation β, whereas Definition 4.1's ρ_β(x) = exp(−π∥x/β∥²) corresponds to a Gaussian with standard deviation β/√(2π). Even if the pancake weights were correct, the noise around each pancake in the output would be wider by a factor √(2π) than the hCLWE density of Definition 4.1. The proof of Claim 2.1 uses ρ_β(z) but the algorithm samples N(0,β); this mismatch reinforces that Algorithm 1 is not an exact sampler for the distribution used in Theorem 2.

minor comments (5)

[Abstract and Section 1] The abstract contains typos ('watermaking', 'purturbations') and the claim that CLUE-Mark 'cannot be detected nor removed by recent steganographic attacks' is too strong: only the specific averaging attack of [39] is evaluated in Section 5.5, and Section 5.6 shows that the watermark is not robust to cropping or rotation.
[§4.3, Figure 4 discussion] The sentence 'the blue area is a histogram generated by a simulation of 10,000 samples using this approximation and is not simply the area under the dashed line (the expected PDF)' is ambiguous; the authors should state explicitly whether the histogram is intended to match the dashed PDF and, if there is a discrepancy, explain it.
[§5.5, RQ4] The Gaussian Shading baseline is evaluated with a fixed key and nonce for all images, which is exactly the setting in which Gaussian Shading's own undetectability proof does not apply. The conclusion that CLUE-Mark 'is robust to standard steganographic attacks unlike the baselines' should be qualified, because the baseline comparison deliberately violates a stated security assumption of Gaussian Shading.
[§5.1, Figure 8] The text says the attack 'is successful with several thousand samples' for γ=1, while the figure's x-axis starts at 10²; a precise statement of the sample counts used for each curve would improve readability. Also, the notation 't. acc.' in the legend is not defined in the caption.
[General] There are several typographical errors (e.g., 'distringuisher' in Theorem 2's proof, 'hypotheseses' in Section 3.2, 'probablity' in Definition 2.4, 'identitical' in Section 2.1, 'Cyphertexts' in Section 6). The paper would benefit from a careful proofreading pass.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: the undetectability proof is a reduction to the external CLWE/hCLWE hardness assumption, and the sampler mismatch in Claim 2.1 is a correctness gap, not a circular step.

full rationale

The central derivation in Section 4.2 is a standard cryptographic reduction: Theorem 2 assumes the hCLWE decision problem is hard and constructs an hCLWE distinguisher from any successful image distinguisher by feeding oracle samples through the diffusion model. The assumption and the target undetectability definition are stated independently, and no parameter in the proof is fitted from the quantity being predicted. Section 5.1 explicitly says the concrete parameters (gamma=2, beta=0.001) are 'based on our empirical evaluations and not on the theoretical reductions,' so the paper does not present those parameter choices as theorem-derived; this is a limitation, not circularity. The proof of Claim 2.1, which asserts that Algorithm 1 exactly samples H_{w,beta,gamma}, appears to replace the actual discrete probability of the rounding choice k with the continuous Gaussian weight rho_{gamma'}(k); at the deployed parameters gamma' approximately 2 this is numerically false (P(1)/P(0) is about 0.885 rather than exp(-pi/4) about 0.456). That is a serious correctness gap between the implemented sampler and the oracle used in Theorem 2, but it is not a circularity: the security reduction itself remains directed at an external hardness assumption, and the flawed step is an invalid equality in a proof rather than an equivalence-by-construction or a self-citation. No load-bearing self-citation appears anywhere in the manuscript, so the circularity score is 0.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

The hCLWE distribution is taken from prior work [4]; the secret direction w is a key, not a new physical entity. No other invented entities appear. Free parameters are empirically fitted, and the main assumptions are the hCLWE hardness assumption and the accuracy of diffusion inversion.

free parameters (4)

gamma (pancake spacing) = 2
Chosen empirically in Section 5.1 so the authors' covariance attack fails for m<=512; violates the gamma=Omega(sqrt(n)) requirement of CLWE reductions for n=32.
beta (noise width) = 0.001
Chosen small to allow recovery after JPEG; no theoretical security justification.
block size n = 32 (2x4x4)
Trade-off between security (larger n) and recovery (more blocks); fixed by hand.
Rayleigh p-value threshold = not specified
Extract needs a threshold to output 0/1; the paper only reports AUC, so the operating point is an implicit free parameter.

assumptions (3)

domain assumption hCLWE hardness with limited samples (Assumption 1.1)
The paper assumes no PPT distinguisher can separate hCLWE from Gaussian with polynomially many samples. This is stronger than the known CLWE theorems and unproven for the chosen parameters.
standard math DWT/IDWT is orthonormal, so N(0,I) is invariant under IDWT
Used in Theorem 2 to match unmarked latent distribution; standard for orthonormal wavelets but not stated explicitly.
domain assumption Diffusion inversion from [15] returns a latent estimate close enough to the true latent
Recovery (completeness) depends on this; not proven in the paper, only empirically evaluated on 100 prompts.

how reviews work

0 comments

Cite this review

Pith. "Pith review of CLUE-MARK: Watermarking Diffusion Models using CLWE." pith.science (2026). https://pith.science/paper/S6R3HULJ

@misc{pith2026241111434,
  author       = {Pith},
  title        = {Pith review of: CLUE-MARK: Watermarking Diffusion Models using CLWE},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/S6R3HULJ}},
  note         = {Machine review of arXiv:2411.11434}
}

read the original abstract

As AI-generated images become widespread, reliable watermarking is essential for content verification, copyright enforcement, and combating disinformation. Existing techniques rely on heuristic approaches and lack formal guarantees of undetectability, making them vulnerable to steganographic attacks that can expose or erase the watermark. Additionally, these techniques often degrade output quality by introducing perceptible changes, which is not only undesirable but an important barrier to adoption in practice. In this work, we introduce CLUE-Mark, the first provably undetectable watermarking scheme for diffusion models. CLUE-Mark requires no changes to the model being watermarked, is computationally efficient, and because it is provably undetectable is guaranteed to have no impact on model output quality. Our approach leverages the Continuous Learning With Errors (CLWE) problem -- a cryptographically hard lattice problem -- to embed watermarks in the latent noise vectors used by diffusion models. By proving undetectability via reduction from a cryptographically hard problem we ensure not only that the watermark is imperceptible to human observers or adhoc heuristics, but to \emph{any} efficient detector that does not have the secret key. CLUE-Mark allows multiple keys to be embedded, enabling traceability of images to specific users without altering model parameters. Empirical evaluations on state-of-the-art diffusion models confirm that CLUE-Mark achieves high recoverability, preserves image quality, and is robust to minor perturbations such JPEG compression and brightness adjustments. Uniquely, CLUE-Mark cannot be detected nor removed by recent steganographic attacks.

Figures

Figures reproduced from arXiv: 2411.11434 by the authors.

**Figure 2.** Watermarking use cases and our threat model, with a per-model (and per-creator) keys. Note that the verifier is given [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

**Figure 4.** The hCLWE PDF with 𝛾 = 2, 𝛽 = 0.1 in the secret direction rescaled for comparison with a standard gaussian. 3.2 Creating Watermarks from CLWE There are several technical challenges we overcome in making CLWE work reliably for diffusion models, which are explained next. Blocking. In order to use samples from the hCLWE distribution as inputs to a diffusion model, we must first overcome a small disparity: The hCLWE dis… view at source ↗

Figures from the paper (7 more)

**Figure 5.** Figure 5: CLUE-Mark signal injection process showing how the latent vector is divided into blocks and transformed using the inverse discrete wavelet transform. albeit with some noise. Dividing the latent vector into blocks is then trivial, but the resulting blocks are subject to…

**Figure 6.** Figure 6: Signal recovery process showing how the latent vector is extracted from the image, divided into blocks, and analyzed [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]

**Figure 7.** Figure 7: Rose diagram of 𝑧𝑖 values from statistical simulation of 10, 000 samples showing the distribution of errors for different cases, where a 𝑧 score of 1.0 is mapped to 360°. problem the distinguisher is given an oracle that for all queries returns samples from either th…

**Figure 8.** Figure 8: Covariance attack scores from statistical simula [PITH_FULL_IMAGE:figures/full_fig_p009_8.png]

**Figure 9.** Figure 9: Image quality as measured by FID to unwater [PITH_FULL_IMAGE:figures/full_fig_p010_9.png]

**Figure 11.** Figure 11: Steganographic attack examples against related schemes. All images generated using the prompt “a dog laying next [PITH_FULL_IMAGE:figures/full_fig_p011_11.png]

**Figure 12.** Figure 12: Robustness to common perturbations as measured [PITH_FULL_IMAGE:figures/full_fig_p011_12.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

46 extracted references · 33 canonical work pages

[1]

Advisory for AI-Generated Content Act, Senate Bill 2765, 118th Con- gress (2023-2024)

2023. Advisory for AI-Generated Content Act, Senate Bill 2765, 118th Con- gress (2023-2024). Text of S. 2765 introduced September 12, 2023. https: //www.congress.gov/bill/118th-congress/senate-bill/2765/text A bill to require watermarking of AI-generated materials, referred to the Committee on Com- merce, Science, and Transportation

work page 2023
[2]

Mahdi Ahmadi, Alireza Norouzi, Nader Karimi, Shadrokh Samavi, and Ali Emami
[3]

Ali Al-Haj. 2007. Combined DWT-DCT digital image watermarking. Journal of computer science (2007)

work page 2007
[4]

Joan Bruna, Oded Regev, Min Jae Song, and Yi Tang. 2021. Continuous LWE. In Proceedings of the 53rd Annual ACM SIGACT Symposium on Theory of Computing (Virtual, Italy) (STOC 2021). Association for Computing Machinery, New York, NY, USA, 694–707. https://doi.org/10.1145/3406325.3451000

arXiv 2021
[5]

Bartz Diane and Hu Krystal. 2024. OpenAI, Google, others pledge to watermark AI content for safety, White House says. https: //www.reuters.com/technology/openai-google-others-pledge-watermark-ai- content-safety-white-house-2023-07-21/

work page 2024
[6]

Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. 2023. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision

work page 2023
[7]

Shafi Goldwasser, Michael P Kim, Vinod Vaikuntanathan, and Or Zamir. 2022. Planting undetectable backdoors in machine learning models. In 2022 IEEE 63rd Annual Symposium on Foundations of Computer Science (FOCS)

work page 2022
[8]

Sam Gunn, Xuandong Zhao, and Dawn Song. 2025. An Undetectable Watermark for Generative Image Models. In The Thirteenth International Conference on Learning Representations. https://openreview.net/forum?id=jlhBFm7T2J

work page 2025

Show all 46 references

[9]

Huiping Guo and Nicolas D Georganas. 2002. Digital image watermarking for joint ownership. In Proceedings of the tenth ACM international conference on Multimedia

2002
[10]

Aparna Gupte, Neekon Vafa, and Vinod Vaikuntanathan. 2022. Continuous LWE is as Hard as LWE & Applications to Learning Gaussian Mixtures. In 2022 IEEE 63rd Annual Symposium on Foundations of Computer Science (FOCS) . 1162–1173. https://doi.org/10.1109/FOCS54457.2022.00112

2022
[11]

Mohamed Hamidi, Mohamed El Haziti, Hocine Cherifi, and Mohammed El Has- souni. 2018. Hybrid blind robust image watermarking technique based on DFT- DCT and Arnold transform. Multimedia Tools and Applications (2018)

2018
[12]

Alex Hern and Dan Milmo. [n. d.]. Spam, junk . . . slop? The latest wave of AI behind the ’zombie internet’. The Guardian (Technology section) ([n. d.]). https://www.theguardian.com/technology/article/2024/may/19/spam- junk-slop-the-latest-wave-of-ai-behind-the-zombie-internet Online

2024
[13]

Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. 2017. Gans trained by a two time-scale update rule converge to a local nash equilibrium. NeurIPS (2017)

2017
[14]

Spam. " Now, With A.I., We’ve Got

Benjamin Hoffman. [n. d.]. First Came "Spam. " Now, With A.I., We’ve Got "Slop. ". The New York Times ([n. d.]). https://www.nytimes.com/2024/06/11/style/ai- search-slop.html Online

2024
[15]

Seongmin Hong, Kyeonghyun Lee, Suh Yoon Jeon, Hyewon Bae, and Se Young Chun. 2024. On Exact Inversion of DPM-Solvers. In CVPR

2024
[16]

Zhaoyang Jia, Han Fang, and Weiming Zhang. 2021. Mbrs: Enhancing robustness of dnn-based watermarking by mini-batch of real and simulated jpeg compres- sion. In Proceedings of the 29th ACM international conference on multimedia

2021
[17]

Deepa Kundur and Dimitrios Hatzinakos. 1997. A robust digital image water- marking method using wavelet-based fusion. In IEEE Proceedings of International Conference on Image Processing

1997
[18]

Sunil Lee, Chang D Yoo, and Ton Kalker. 2007. Reversible image watermarking based on integer-to-integer wavelet transform. IEEE Transactions on information forensics and security (2007)

2007
[19]

Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. 2014. Microsoft coco: Common objects in context. In ECCV

2014
[20]

Yang Liu, Mengxi Guo, Jian Zhang, Yuesheng Zhu, and Xiaodong Xie. 2019. A novel two-stage separable deep learning framework for practical blind water- marking. In Proceedings of the 27th ACM International conference on multimedia

2019
[21]

2023.{PTW}: Pivotal Tuning Watermarking for{Pre-Trained} Image Generators

Nils Lukas and Florian Kerschbaum. 2023.{PTW}: Pivotal Tuning Watermarking for{Pre-Trained} Image Generators. In USENIX Security

2023
[22]

Tambiama Madiega. 2023. Generative AI and watermarking. https: //www.europarl.europa.eu/RegData/etudes/BRIE/2023/757583/EPRS_BRI(2023) 757583_EN.pdf

2023
[23]

Arwa Mahdawi. [n. d.]. AI-generated ’slop’ is slowly killing the in- ternet, so why is nobody trying to stop it? The Guardian ([n. d.]). https://www.theguardian.com/global/commentisfree/2025/jan/08/ai- generated-slop-slowly-killing-internet-nobody-trying-to-stop-it Online

2025
[24]

Nesrine Malik. 2025. ’AI Slop’ Is Turning the Internet into a Junkyard. The Guardian (April 2025). https://www.theguardian.com/commentisfree/2025/apr/ 21/ai-slop-artificial-intelligence-social-media

2025
[25]

Office of Public Affairs. 2024. Department of Commerce Announces New Actions to Implement President Biden’s Executive Order on AI. https://www.commerce.gov/news/press-releases/2024/04/department- commerce-announces-new-actions-implement-president-bidens

2024
[26]

John Oliver. 2025. AI Slop. https://www.youtube.com/watch?v=TWpg1RmzAbc. Last Week Tonight with John Oliver, HBO, aired June 23, 2025

2025
[27]

Qi Pang, Shengyuan Hu, Wenting Zheng, and Virginia Smith. 2024. No Free Lunch in LLM Watermarking: Trade-offs in Watermarking Design Choices. arXiv:2402.16187 https://arxiv.org/abs/2402.16187

2024 arXiv
[28]

Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. 2023. Sdxl: Improving latent diffu- sion models for high-resolution image synthesis. arXiv preprint arXiv:2307.01952 (2023)

2023 arXiv
[29]

Max Read. [n. d.]. Drowning in Slop. New York Magazine (Intelligencer) ([n. d.]). https://nymag.com/intelligencer/article/ai-generated-content-internet- online-slop-spam.html Online
[30]

Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. 2022. High-resolution image synthesis with latent diffusion models. In CVPR

2022
[31]

Graeme D. Ruxton. 2017. Testing for departure from uniformity and estimating mean direction for circular data. Biology Letters 13, 1 (2017), 20160756. https: //doi.org/10.1098/rsbl.2016.0756

2017
[32]

Deepa Seetharaman and Matt Barnum. 2023. There’s a tool to catch students cheating with ChatGPT. OpenAI hasn’t released it.The Wall Street Journal (2023). https://www.wsj.com/tech/ai/openai-tool-chatgpt-cheating-writing-135b755a

2023
[33]

Jiaming Song, Chenlin Meng, and Stefano Ermon. 2020. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502 (2020)

2020 arXiv
[34]

Matthew Tancik, Ben Mildenhall, and Ren Ng. 2020. Stegastamp: Invisible hyperlinks in physical photographs. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

2020
[35]

Min-Jen Tsai, Kuang-Yao Yu, and Yi-Zhang Chen. 2000. Joint wavelet and spa- tial transformation for digital watermarking. IEEE Transactions on Consumer Electronics (2000)

2000
[36]

Ron G Van Schyndel, Andrew Z Tirkel, and Charles F Osborne. 1994. A digital watermark. In IEEE Proceedings of 1st international conference on image processing

1994
[37]

Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. 2023. Tree- Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust. arXiv:2305.20030 https://arxiv.org/abs/2305.20030

2023 arXiv
[38]

Ling Yang, Zhilong Zhang, Yang Song, Shenda Hong, Runsheng Xu, Yue Zhao, Wentao Zhang, Bin Cui, and Ming-Hsuan Yang. 2023. Diffusion models: A comprehensive survey of methods and applications. Comput. Surveys (2023)

2023
[39]

Pei Yang, Hai Ci, Yiren Song, and Mike Zheng Shou. 2024. Steganalysis on Digital Watermarking: Is Your Defense Truly Impervious? arXiv:2406.09026 https://arxiv.org/abs/2406.09026

2024 arXiv
[40]

Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu
[41]

Ning Yu, Vladislav Skripniuk, Sahar Abdelnabi, and Mario Fritz. 2021. Artificial fingerprinting for generative models: Rooting deepfake attribution in training data. In ICCV

2021
[42]

Ning Yu, Vladislav Skripniuk, Dingfan Chen, Larry Davis, and Mario Fritz. 2022. Responsible disclosure of generative models using scalable fingerprinting. ICLR (2022)

2022
[43]

Edelman, Danilo Francati, Daniele Venturi, Giuseppe Ateniese, and Boaz Barak

Hanlin Zhang, Benjamin L. Edelman, Danilo Francati, Daniele Venturi, Giuseppe Ateniese, and Boaz Barak. 2024. Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models. arXiv:2311.04378 https://arxiv.org/abs/ 2311.04378

2024 arXiv
[44]

J Zhu. 2018. HiDDeN: hiding data with deep networks. arXiv preprint arXiv:1807.09937 (2018). A ARE PERFECT W ATERMARKS POSSIBLE? Ideally, a watermark should be robust in the sense that pertur- bations that do not affect the image quality should not remove the watermark. Unfort...

2018 arXiv
[2020]

Expert Systems with Applications (2020)

ReDMark: Framework for residual diffusion watermarking based on deep networks. Expert Systems with Applications (2020)

2020
[2024]

arXiv:2404.04956 https://arxiv.org/abs/2404.04956

Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models. arXiv:2404.04956 https://arxiv.org/abs/2404.04956

arXiv

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.

[1] [1]

Advisory for AI-Generated Content Act, Senate Bill 2765, 118th Con- gress (2023-2024)

2023. Advisory for AI-Generated Content Act, Senate Bill 2765, 118th Con- gress (2023-2024). Text of S. 2765 introduced September 12, 2023. https: //www.congress.gov/bill/118th-congress/senate-bill/2765/text A bill to require watermarking of AI-generated materials, referred to the Committee on Com- merce, Science, and Transportation

work page 2023

[2] [2]

Mahdi Ahmadi, Alireza Norouzi, Nader Karimi, Shadrokh Samavi, and Ali Emami

[3] [3]

Ali Al-Haj. 2007. Combined DWT-DCT digital image watermarking. Journal of computer science (2007)

work page 2007

[4] [4]

Joan Bruna, Oded Regev, Min Jae Song, and Yi Tang. 2021. Continuous LWE. In Proceedings of the 53rd Annual ACM SIGACT Symposium on Theory of Computing (Virtual, Italy) (STOC 2021). Association for Computing Machinery, New York, NY, USA, 694–707. https://doi.org/10.1145/3406325.3451000

arXiv 2021

[5] [5]

Bartz Diane and Hu Krystal. 2024. OpenAI, Google, others pledge to watermark AI content for safety, White House says. https: //www.reuters.com/technology/openai-google-others-pledge-watermark-ai- content-safety-white-house-2023-07-21/

work page 2024

[6] [6]

Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. 2023. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision

work page 2023

[7] [7]

Shafi Goldwasser, Michael P Kim, Vinod Vaikuntanathan, and Or Zamir. 2022. Planting undetectable backdoors in machine learning models. In 2022 IEEE 63rd Annual Symposium on Foundations of Computer Science (FOCS)

work page 2022

[8] [8]

Sam Gunn, Xuandong Zhao, and Dawn Song. 2025. An Undetectable Watermark for Generative Image Models. In The Thirteenth International Conference on Learning Representations. https://openreview.net/forum?id=jlhBFm7T2J

work page 2025