Pith. sign in

REVIEW 4 major objections 5 minor 3 cited by

Gaussian Shading++: Rethinking the Realistic Deployment Challenge of Performance-Lossless Image Watermark for Diffusion Models

T0 review · 4 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Gaussian Shading++ claims a fixed-key, performance-lossless watermark for diffusion images that also survives changed generation parameters and supports third-party verification.

desk verdict A solid incremental advance that fixes key management for performance-lossless diffusion watermarks and shows clear robustness gains under guidance mismatch, but the AWGN noise model is asserted rather than validated and one decoding equation has a real off-by-factor-8 error. read the letter →

arxiv 2504.15026 v2 pith:X2RFOHCM submitted 2025-04-21 cs.CV cs.CR

Zijin Yang , Xin Zhang , Kejiang Chen , Kai Zeng , Qiyi Yao , Han Fang , Weiming Zhang , Nenghai Yu This is my paper · ORCID
classification cs.CVcs.CR
keywords diffusionmodelwatermarkperformance-losslesspseudorandomerror-correctingcodessoftdecisiondecodingAWGNchannellatentrepresentationwatermarkingthird-partyverificationguidancescalerobustness
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper introduces a watermarking scheme for diffusion-generated images that targets three deployment problems at once: watermarking should not shift the distribution of generated images, it should work with one fixed key instead of a unique key per image, and it should stay readable when the user's generation settings (notably the guidance scale) differ from the settings used during verification. The central idea is to split the latent space into two channels: a header channel encodes a freshly sampled random seed with pseudorandom error-correcting codes, and a payload channel encrypts and repeats the actual watermark under a stream key derived from that seed. Because the seed changes with every image, the watermark ciphertext stays pseudorandom even though the key is fixed; because the bit-to-latent mapping preserves the Gaussian distribution, watermarked latents are statistically indistinguishable from normal samples. During extraction the paper models the entire generation-plus-inversion loop as an additive white Gaussian noise channel with $\sigma=\sqrt{3/2}$ and decodes the payload through soft-decision log-likelihood aggregation, which is what keeps the watermark alive under mismatched parameters. If the claims hold, the scheme would remove key management and parameter sensitivity as blockers to real-world deployment, and a public-key signature variant would allow any third party to verify ownership.

What carries the argument

The carrying mechanism is a double-channel watermark in the latent space, with one channel as the header and one as the payload. The header channel uses an LDPC-based pseudorandom error-correcting code to encode a fresh random seed; this seed, together with a private key, drives a pseudorandom generator whose output encrypts the diffused watermark in the payload channel. Distribution-preserving sampling then maps the combined pseudorandom bit string into latent values by inverse cumulative-distribution intervals, so the watermarked latents follow $\mathcal{N}(0,I)$ exactly rather than being merely close to normal. For extraction, the paper uses exact inversion to recover $z'_T$, estimates each latent symbol by the AWGN posterior with $\sigma=\sqrt{3/2}$ through the error function, and aggregates repeated watermark bits into LLRs, whose sign is the final decoded bit.

What would settle it

Generate watermarked images with known seeds, run the full extraction pipeline, and replace the fixed-variance Gaussian posterior estimate with a decoder built from the empirical distribution of the residual $z'_T - z_T$ measured on a held-out set; if the empirical decoder gives substantially higher bit accuracy, then the fixed AWGN model is the wrong assumption. A simpler diagnostic is to estimate the residual variance separately for each guidance scale used during generation: if it moves with the guidance scale instead of staying at $\sigma^2=3/2$, the model is an approximation rather than the true channel.

Watch

Extended reading notes

Core claim

The paper's central claim is that latent-space diffusion watermarking no longer needs to trade losslessness against key simplicity or robustness. It asserts that by encoding a fresh random seed in a PRC-protected header and using that seed to drive the Gaussian-Shading payload channel, the whole watermark ciphertext is pseudorandom under a fixed key, and the proof reduces performance-losslessness to the IND$-CPA security of the construction. On recovery, it asserts that the distortions of generation and inversion can be treated as an AWGN channel, allowing each repeated payload bit to be summarized by a posterior expectation and combined into a log-likelihood ratio, a soft-decision rule that performs near MAP decoding. The paper reports that this soft decoding is what lifts robustness under guidance-scale mismatch relative to the hard-decision PRCW baseline. Finally, it claims that adding a public-key signature to the payload enables any third party to verify and trace images while providing partial resistance to reprompt forgery, at the explicit cost of no longer offering undetectability in that public mode.

Load-bearing premise

The load-bearing premise is that everything between embedding and extraction behaves like additive white Gaussian noise with one fixed variance, $\sigma^2=3/2$; if the real distortion, especially at mismatched guidance scales, is non-Gaussian or has a different variance, the claimed near-optimality of the soft-decision decoder is not guaranteed.

Editorial extensions

If this is right

  • A deployed service can keep a single watermark key and still embed a fresh pseudorandom watermark into every image, so tracing a user no longer requires per-image key storage or transmission.
  • A verification pipeline can run without knowing the user's guidance scale; the reported experiments hold up across generation guidance 3 to 15 while inversion stays at guidance 3, where the hard-decision baseline degrades sharply.
  • Because the ciphertext is IND$-CPA secure and the latent distribution is preserved, the watermark adds no measurable FID or CLIP-Score shift, which supports its use in quality-sensitive commercial generation.
  • Public verification with ECDSA lets an arbitrary third party authenticate an image using only a public key, and roughly reduces the success of reprompt forgery attacks in the tested settings, though similar-parameter proxy models remain a residual risk.
  • The header channel is the robustness bottleneck: when erasure-style attacks such as VQ-VAE reconstruction destroy the seed, the payload cannot be decoded even though the payload channel itself remains strong.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves implicit that the fixed $\sigma=\sqrt{3/2}$ could be replaced by an adaptive noise estimate per image, which would likely extend the guidance-scale range and attack classes the soft-decision decoder can handle.
  • The latent-normality evidence is marginal, so a stronger check on performance-losslessness would test conditional independence between header and payload channels, not only the marginal normality of the full latent vector.
  • The operator and third-party modes are different security targets; a future design could separate them with a key hierarchy so that public verification does not force the watermark to give up undetectability against the operator.
  • The AWGN model plus repetition coding gives a closed-form capacity-robustness tradeoff; platform operators could use it to select replication factors and false-positive thresholds analytically instead of by experiment.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes Gaussian Shading++, a watermarking scheme for latent diffusion models that addresses three deployment challenges: fixed-key performance-lossless embedding, robustness to mismatched generation parameters, and third-party verifiability. The latent space is split into a PRC channel, which encodes a freshly sampled seed using pseudorandom error-correcting codes, and a GS channel, which embeds the watermark encrypted by a stream cipher derived from that seed. Extraction uses Exact Inversion followed by a soft-decision decoder derived from an AWGN channel model, and a public-key signature (ECDSA) is added for public verification. The paper claims a provable performance-lossless guarantee via an IND$-CPA security proof and reports experiments on SD V2.1 showing improved robustness over PRCW under guidance-scale mismatch and state-of-the-art distribution preservation.

Significance. If the claims hold, this is a practically valuable contribution: it is the first scheme I am aware of that combines a fixed watermark key with per-image pseudorandomness, explicit robustness to unknown guidance scales, and public verification in one latent-space watermarking framework. The manuscript deserves credit for shipping a formal security proof sketch (Theorem 1), an extensive robustness evaluation against six distortions and five removal attacks, a normality-test battery on 80,000 latent vectors, and an ablation study isolating the PRC, the soft-decision decoder, and channel placement. The distribution-preserving sampling argument in Sec. IV-B3 is clean and correctly reduces performance losslessness to pseudorandomness of the driving bitstream. However, the central robustness contribution is built on an AWGN residual model whose variance is asserted rather than measured, and a formula inconsistency in the repetition-count derivation weakens the decoding description; these issues must be resolved before the results can be fully trusted.

major comments (4)
  1. [Sec. IV-C1, Eq. (8)] The AWGN channel model with fixed noise standard deviation sigma = sqrt(3/2) is asserted without empirical validation. The posterior estimate m'_z = erf(z'_T / sqrt(2*sigma^2*(1+sigma^2))) and the entire soft-decision decoding pipeline in Eqs. (10)-(14) are exact only if the residual z'_T - z_T is zero-mean i.i.d. Gaussian with variance sigma^2 across all latent dimensions. The paper never measures this residual, and it is especially important to validate the model under the target deployment condition of Sec. V-C5, where the guidance scale during generation is 3, 6, 9, 12, or 15 while inversion is always at guidance 3. Exact Inversion residuals are known to be prompt- and guidance-dependent rather than i.i.d. Gaussian, so the model may be substantially misspecified; without a residual distribution analysis, the claimed near-optimal MAP decoding is not established.
  2. [Sec. IV-C3, Eq. (12)] The repetition count in Eq. (12) is given as num = ch*h*w/(2*fch*fhw^2), which for the default settings (ch=4, h=w=64, fch=2, fhw=4) equals 256. This is the watermark capacity q, not the number of repetitions per bit. According to the construction in Sec. IV-B2, each watermark bit is replicated fch*fhw^2 = 32 times. As written, Eq. (12) sums 256 terms rather than 32, which is internally inconsistent with the stated replication construction and would overcount the LLR aggregation by a factor of 8. Please correct the formula or clarify what 'num' denotes.
  3. [Sec. IV-D, Proof step (1)] The hybrid argument replaces H(seed||skc) with a random string by arguing that an adversary would need to query the random oracle at exactly seed||skc, and that each query hits the correct input with probability at most 2^{-k} because skc is a k-bit secret. This argument neglects the information about seed that the adversary obtains from the observed PRC codeword G*seed XOR e. A rigorous reduction must show that recovering seed from the PRC codeword (or otherwise identifying seed||skc) is hard under the stated LPN/PRC assumptions. As written, the proof of IND$-CPA security has a gap in step (1), which is load-bearing for the provable performance-lossless claim.
  4. [Sec. V-A2 and Sec. II-E] The parameters of the pseudorandom error-correcting code are not specified. The KeyGen procedure in Sec. II-E requires (n, g, t, r), and the Encode procedure uses a Bernoulli noise rate eta, but Sec. V-A2 only states that a 32-bit seed is encoded. Without these values (block length, sparsity, number of parity checks, and noise rate), the PRC channel's error-correction capability and pseudorandomness regime cannot be assessed, and the experiments are not reproducible. Please report the exact PRC parameters used in the main experiments and ablations.
minor comments (5)
  1. [Sec. V-B2, Table I] The sentence 'with traceability accuracy remaining above 70%' is technically true only for the non-filtering distortions (all values are at least 0.714), but juxtaposed with the 0.158 and 0.358 values for GauBlur and MedFilter it may mislead a casual reader; consider stating the filtered cases explicitly in the text.
  2. [Table V] The K-S statistic for Gaussian Shading++ is printed as '2.2996 / 0.4922' without the negative exponent, which makes it appear inconsistent with the PRCW row (2.3074e-5 / 0.4877). Use consistent scientific notation in the table.
  3. [Eq. (14)] The claim that the first-order approximation of arctanh 'shows negligible performance difference' is not supported by any numerical comparison in the paper; either provide the comparison or soften the claim to 'empirically small difference'.
  4. [Sec. IV-D and Sec. IV-A] The proof assumes that skc remains secret, but in the Third-party Verification scenario (Sec. IV-A) skc is made public together with (P, G). The manuscript correctly notes at the end of Sec. IV-D that undetectability is not claimed in that setting, but this distinction should be stated at the beginning of the proof to avoid an apparent contradiction.
  5. [Fig. 6 and Fig. 7] The axis labels are garbled with placeholder-like unicode symbols (e.g., '10010 3 10 6 10 9 10 12 /uni00000029/...'). Replace them with proper mathematical notation such as '10^{-3}', '10^{-6}', and standard curve labels.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the central claims are empirical measurements or proofs from external cryptographic assumptions; self-citations are not load-bearing.

full rationale

Gaussian Shading++'s derivation chain is self-contained against external benchmarks. The embedding pipeline (Sec. IV-B) defines the watermark distribution and Eqs. (4)-(7) prove by construction that the sampled latent is marginally N(0,I), so the performance-lossless claim does not reduce to a fit. The IND$-CPA proof (Sec. IV-D) is a standard hybrid argument whose load-bearing hardness assumptions are LPN, PRNG pseudorandomness, and the random-oracle model, imported from the external PRC paper [29], not from the authors' own prior work. The robustness results (Tabs. III and VI) are direct empirical measurements of a concrete decoder; they are not fitted parameters renamed as predictions. Self-citations to Gaussian Shading [27] describe a predecessor algorithm and a hard-decision baseline; the soft-decision contribution (Eqs. (8)-(14)) does not depend on those citations for its validity. The AWGN model with sigma = sqrt(3/2) in Sec. IV-C1 is an explicitly stated modeling assumption inherited from Gunn et al. [29]. Its lack of validation under guidance-scale mismatch is a correctness risk or a limitation, but not a circularity, because the paper does not fit sigma to the target data and then claim the fitted value as a prediction. One non-circular manuscript inconsistency worth flagging: Eq. (12) gives the repetition count as num = ch*h*w/(2*fch*fhw^2), which equals the 256-bit capacity when v=1 rather than the fch*fhw^2 = 32 repetitions implied by the stated replication construction; this is an internal-consistency/correctness issue, not a circular dependency. Overall, no load-bearing step reduces by construction or by self-citation to its own inputs.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The scheme's proof rests on standard cryptographic hardness assumptions and the distribution-preserving sampling identity; the main non-standard input is the AWGN model with a fixed noise variance, which is asserted rather than measured. The paper releases no code, and key LDPC parameters are omitted.

free parameters (4)
  • AWGN noise standard deviation sigma = sqrt(3/2)
    Assumed noise level for the generation/inversion channel; used in Eq. 8 for posterior estimation and in the LLR decoding. Not estimated from this paper's data; taken from prior watermark modeling. Robustness gains depend on this value.
  • PRC LDPC noise rate eta = not reported
    The PRC encode step samples e from Ber(n, eta) (Sec. II-E). The decoder's BP-OSD needs eta, but the paper never states the value used in experiments, so the robustness measurements cannot be reproduced exactly.
  • Repetition factors fch, fhw, bits per latent v = fch=2, fhw=4, v=1
    Hand-chosen in Sec. V-A2 to give a 256-bit payload. These affect capacity and robustness, but the scheme is not fitted to a particular target; they are design choices.
  • PRC seed length and code dimensions = 32-bit seed; LDPC (n,g,t,r) unspecified
    Chosen in Sec. V-A2; the exact LDPC parameters are not given, making exact reproduction impossible.
assumptions (5)
  • domain assumption Pseudorandomness of the PRC construction under the (subexponential or standard plus planted XOR) LPN assumption.
    Invoked in Sec. II-E and Theorem 1 step (2) to argue the header ciphertext is indistinguishable from random.
  • domain assumption PRNG is a secure pseudorandom generator and H is a random oracle.
    Needed for the IND$-CPA proof in Sec. IV-D steps (1) and (3).
  • standard math Distribution-preserving sampling property: quantizing a Gaussian into 2^v equal-probability bins and sampling within the bin yields a standard Gaussian.
    Eqs. 4-7; this is a mathematical fact used to claim performance losslessness.
  • domain assumption Exact Inversion [31] recovers z'_T close enough to the embedded z_T.
    Sec. IV-C1; extraction assumes the inversion error is small and can be absorbed by the AWGN model.
  • domain assumption The AWGN model with fixed sigma accurately describes generation and inversion distortion.
    Sec. IV-C1; this is the load-bearing modeling assumption for soft-decision decoding.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Gaussian Shading++: Rethinking the Realistic Deployment Challenge of Performance-Lossless Image Watermark for Diffusion Models." pith.science (2026). https://pith.science/paper/X2RFOHCM

@misc{pith2026250415026,
  author       = {Pith},
  title        = {Pith review of: Gaussian Shading++: Rethinking the Realistic Deployment Challenge of Performance-Lossless Image Watermark for Diffusion Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/X2RFOHCM}},
  note         = {Machine review of arXiv:2504.15026}
}
read the original abstract

Ethical concerns surrounding copyright protection and inappropriate content generation pose challenges for the practical implementation of diffusion models. One effective solution involves watermarking the generated images. Existing methods primarily focus on ensuring that watermark embedding does not degrade the model performance. However, they often overlook critical challenges in real-world deployment scenarios, such as the complexity of watermark key management, user-defined generation parameters, and the difficulty of verification by arbitrary third parties. To address this issue, we propose Gaussian Shading++, a diffusion model watermarking method tailored for real-world deployment. We propose a double-channel design that leverages pseudorandom error-correcting codes to encode the random seed required for watermark pseudorandomization, achieving performance-lossless watermarking under a fixed watermark key and overcoming key management challenges. Additionally, we model the distortions introduced during generation and inversion as an additive white Gaussian noise channel and employ a novel soft decision decoding strategy during extraction, ensuring strong robustness even when generation parameters vary. To enable third-party verification, we incorporate public key signatures, which provide a certain level of resistance against forgery attacks even when model inversion capabilities are fully disclosed. Extensive experiments demonstrate that Gaussian Shading++ not only maintains performance losslessness but also outperforms existing methods in terms of robustness, making it a more practical solution for real-world deployment.

Figures

Figures reproduced from arXiv: 2504.15026 by the authors.

Figure 1
Figure 1. Existing watermarking frameworks can be divided into three [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. The two application scenarios of Gaussian Shading++ are Operator Verification and Third-party Verification. In the Operator Verification scenario, [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. The framework of Gaussian Shading++. The latent space is divided into the PRC Channel and GS Channel. During the watermark key generation, a [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: The hardness of distinguishing between H0 and H3. (1) The advantage of distinguishing H0 from H1 is negligi￾ble if the hash function H is modeled as a random oracle and the assumption that skc remains secret. Specifically, since the adversary does not know skc, and see…
Figure 5
Figure 5. Figure 5: Watermarked images generated using different watermarking methods with the same prompt: “ [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: Performance of Gaussian Shading++ in Operator Verification scenario. The results are presented separately for detection and traceability tasks. [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 7
Figure 7. Figure 7: Comparison of robustness under removal attacks. The first row presents the TPR of watermark methods, while the second row shows their bit accuracy. [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]
Figure 8
Figure 8. Figure 8: Ablation study on different noise strengths. [PITH_FULL_IMAGE:figures/full_fig_p015_8.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 3 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Improved Pseudorandom Codes from Permuted Puzzles

    cs.CR 2025-12 conditional novelty 8.0 of 10

    Under a new "permuted codes" assumption, the paper builds binary pseudorandom codes and LLM watermarks that tolerate constant-rate worst-case edits and key-knowledgeable adversaries.

  2. FARI: Robust One-Step Inversion for Watermarking in Diffusion Models

    cs.CR 2026-07 accept novelty 6.0 of 10

    One-step adversarially LoRA-tuned inversion exploits low-curvature reverse trajectories to beat 50-step DDIM on watermark robustness after ~20 minutes of fine-tuning.

  3. DNA: Dual-stage Native Attribution for Generated Image Source Tracing

    cs.CV 2026-07 conditional novelty 6.0 of 10

    A training-free two-stage framework (family-level VAE screening + backbone-level native-prediction scoring) traces generated images to specific within-family model variants at 89.11% end-to-end accuracy on a new open-...

Reference graph

Works this paper leans on

84 extracted references · 37 canonical work pages · cited by 3 Pith papers

  1. [1]

    Deep unsupervised learning using nonequilibrium thermodynamics,

    J. Sohl-Dickstein, E. Weiss, N. Maheswaranathan, and S. Ganguli, “Deep unsupervised learning using nonequilibrium thermodynamics,” in International conference on machine learning . PMLR, 2015, pp. 2256–2265

    2015

  2. [2]

    Generative modeling by estimating gradients of the data distribution,

    Y . Song and S. Ermon, “Generative modeling by estimating gradients of the data distribution,” Advances in neural information processing systems, vol. 32, 2019

    2019

  3. [3]

    Score-based generative modeling through stochastic differ- ential equations,

    Y . Song, J. Sohl-Dickstein, D. P. Kingma, A. Kumar, S. Ermon, and B. Poole, “Score-based generative modeling through stochastic differ- ential equations,” in International Conference on Learning Representa- tions, 2020

    2020

  4. [4]

    Denoising diffusion probabilistic models,

    J. Ho, A. Jain, and P. Abbeel, “Denoising diffusion probabilistic models,” Advances in neural information processing systems , vol. 33, pp. 6840– 6851, 2020

    2020

  5. [5]

    Denoising diffusion implicit models,

    J. Song, C. Meng, and S. Ermon, “Denoising diffusion implicit models,” in International Conference on Learning Representations , 2020

    2020

  6. [6]

    High- resolution image synthesis with latent diffusion models,

    R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer, “High- resolution image synthesis with latent diffusion models,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2022, pp. 10 684–10 695

    2022

  7. [7]

    Glide: Towards photorealistic image gen- eration and editing with text-guided diffusion models,

    A. Nichol, P. Dhariwal, A. Ramesh, P. Shyam, P. Mishkin, B. McGrew, I. Sutskever, and M. Chen, “Glide: Towards photorealistic image gen- eration and editing with text-guided diffusion models,” arXiv preprint arXiv:2112.10741, 2021

    arXiv 2021

  8. [8]

    I. Cox, M. Miller, J. Bloom, J. Fridrich, and T. Kalker, Digital water- marking and steganography . Morgan kaufmann, 2007

    2007

Show all 84 references
  1. [9]

    Robust invisible video watermarking with attention,

    K. A. Zhang, L. Xu, A. Cuesta-Infante, and K. Veeramachaneni, “Robust invisible video watermarking with attention,” arXiv preprint arXiv:1909.01285, 2019

    1909 arXiv

  2. [10]

    Hidden: Hiding data with deep networks,

    J. Zhu, R. Kaplan, J. Johnson, and L. Fei-Fei, “Hidden: Hiding data with deep networks,” in Proceedings of the European conference on computer vision (ECCV), 2018, pp. 657–672

    2018

  3. [11]

    Distortion ag- nostic deep watermarking,

    X. Luo, R. Zhan, H. Chang, F. Yang, and P. Milanfar, “Distortion ag- nostic deep watermarking,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2020, pp. 13 548–13 557

    2020

  4. [12]

    Udh: Universal deep hiding for steganography, watermarking, and light field messag- ing,

    C. Zhang, P. Benz, A. Karjauv, G. Sun, and I. S. Kweon, “Udh: Universal deep hiding for steganography, watermarking, and light field messag- ing,” Advances in Neural Information Processing Systems , vol. 33, pp. 10 223–10 234, 2020

    2020

  5. [13]

    Fixed neural network steganography: Train the images, not the network,

    V . Kishore, X. Chen, Y . Wang, B. Li, and K. Q. Weinberger, “Fixed neural network steganography: Train the images, not the network,” in International Conference on Learning Representations , 2021

    2021

  6. [14]

    Stegastamp: Invisible hyperlinks in physical photographs,

    M. Tancik, B. Mildenhall, and R. Ng, “Stegastamp: Invisible hyperlinks in physical photographs,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2020, pp. 2117–2126

    2020

  7. [15]

    An automated and robust image watermarking scheme based on deep neural networks,

    X. Zhong, P.-C. Huang, S. Mastorakis, and F. Y . Shih, “An automated and robust image watermarking scheme based on deep neural networks,” IEEE Transactions on Multimedia , vol. 23, pp. 1951–1961, 2020

    1951

  8. [16]

    Mbrs: Enhancing robustness of dnn- based watermarking by mini-batch of real and simulated jpeg com- pression,

    Z. Jia, H. Fang, and W. Zhang, “Mbrs: Enhancing robustness of dnn- based watermarking by mini-batch of real and simulated jpeg com- pression,” in Proceedings of the 29th ACM international conference on multimedia, 2021, pp. 41–49

    2021

  9. [17]

    Towards blind watermarking: Combining invertible and non-invertible mecha- nisms,

    R. Ma, M. Guo, Y . Hou, F. Yang, Y . Li, H. Jia, and X. Xie, “Towards blind watermarking: Combining invertible and non-invertible mecha- nisms,” in Proceedings of the 30th ACM International Conference on Multimedia, 2022, pp. 1532–1542

    2022

  10. [18]

    Watermarking images in self-supervised latent spaces,

    P. Fernandez, A. Sablayrolles, T. Furon, H. J ´egou, and M. Douze, “Watermarking images in self-supervised latent spaces,” in ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) . IEEE, 2022, pp. 3054–3058

    2022

  11. [19]

    Pimog: An effective screen-shooting noise-layer simulation for deep-learning-based watermarking network,

    H. Fang, Z. Jia, Z. Ma, E.-C. Chang, and W. Zhang, “Pimog: An effective screen-shooting noise-layer simulation for deep-learning-based watermarking network,” in Proceedings of the 30th ACM international conference on multimedia , 2022, pp. 2267–2275

    2022

  12. [20]

    Flow-based robust watermarking with invertible noise layer for black- box distortions,

    H. Fang, Y . Qiu, K. Chen, J. Zhang, W. Zhang, and E.-C. Chang, “Flow-based robust watermarking with invertible noise layer for black- box distortions,” in Proceedings of the AAAI conference on artificial intelligence, vol. 37, no. 4, 2023, pp. 5054–5061

    2023

  13. [21]

    The stable signature: Rooting watermarks in latent diffusion models,

    P. Fernandez, G. Couairon, H. J ´egou, M. Douze, and T. Furon, “The stable signature: Rooting watermarks in latent diffusion models,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 22 466–22 477

    2023

  14. [22]

    A recipe for watermarking diffusion models,

    Y . Zhao, T. Pang, C. Du, X. Yang, N.-M. Cheung, and M. Lin, “A recipe for watermarking diffusion models,” arXiv preprint arXiv:2303.10137 , 2023

    2023 arXiv

  15. [23]

    Watermarking diffusion model,

    Y . Liu, Z. Li, M. Backes, Y . Shen, and Y . Zhang, “Watermarking diffusion model,” arXiv preprint arXiv:2305.12502 , 2023

    2023 arXiv

  16. [24]

    Diffusion- shield: A watermark for copyright protection against generative diffusion models,

    Y . Cui, J. Ren, H. Xu, P. He, H. Liu, L. Sun, and J. Tang, “Diffusion- shield: A watermark for copyright protection against generative diffusion models,” arXiv preprint arXiv:2306.04642 , 2023

    2023 arXiv

  17. [25]

    Flexible and secure watermarking for latent diffusion model,

    C. Xiong, C. Qin, G. Feng, and X. Zhang, “Flexible and secure watermarking for latent diffusion model,” in Proceedings of the 31st ACM International Conference on Multimedia , 2023, pp. 1668–1676

    2023

  18. [26]

    Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust,

    Y . Wen, J. Kirchenbauer, J. Geiping, and T. Goldstein, “Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust,” arXiv preprint arXiv:2305.20030 , 2023

    2023 arXiv

  19. [27]

    Gaussian shading: Provable performance-lossless image watermarking for diffu- sion models,

    Z. Yang, K. Zeng, K. Chen, H. Fang, W. Zhang, and N. Yu, “Gaussian shading: Provable performance-lossless image watermarking for diffu- sion models,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2024, pp. 12 162–12 171

    2024

  20. [28]

    An undetectable watermark for generative image models,

    S. Gunn, X. Zhao, and D. Song, “An undetectable watermark for generative image models,” in The Thirteenth International Conference on Learning Representations . 17

  21. [29]

    Pseudorandom error-correcting codes,

    M. Christ and S. Gunn, “Pseudorandom error-correcting codes,” in Annual International Cryptology Conference. Springer, 2024, pp. 325– 347

    2024

  22. [30]

    On the difficulty of constructing a robust and publicly-detectable watermark,

    J. Fairoze, G. Ortiz-Jim ´enez, M. Vecerik, S. Jha, and S. Gowal, “On the difficulty of constructing a robust and publicly-detectable watermark,”

  23. [31]

    On exact inversion of dpm-solvers,

    S. Hong, K. Lee, S. Y . Jeon, H. Bae, and S. Y . Chun, “On exact inversion of dpm-solvers,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , June 2024, pp. 7069–7078

    2024

  24. [33]

    Black-box forgery attacks on semantic watermarks for diffusion models,

    A. M ¨uller, D. Lukovnikov, J. Thietke, A. Fischer, and E. Quiring, “Black-box forgery attacks on semantic watermarks for diffusion models,” 2024. [Online]. Available: https://arxiv.org/abs/2412.03283

    2024 arXiv

  25. [34]

    62: public key cryptography for the financial services industry: the elliptic curve digital signature algorithm (ecdsa),

    X. ANSI, “62: public key cryptography for the financial services industry: the elliptic curve digital signature algorithm (ecdsa),”Am. Nat’l Standards Inst, 1999

    1999

  26. [35]

    Vari- ational image compression with a scale hyperprior,

    J. Ball ´e, D. Minnen, S. Singh, S. J. Hwang, and N. Johnston, “Vari- ational image compression with a scale hyperprior,” arXiv preprint arXiv:1802.01436, 2018

    2018 arXiv

  27. [36]

    Learned image com- pression with discretized gaussian mixture likelihoods and attention modules,

    Z. Cheng, H. Sun, M. Takeuchi, and J. Katto, “Learned image com- pression with discretized gaussian mixture likelihoods and attention modules,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2020, pp. 7939–7948

    2020

  28. [37]

    Taming transformers for high- resolution image synthesis,

    P. Esser, R. Rombach, and B. Ommer, “Taming transformers for high- resolution image synthesis,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2021, pp. 12 873–12 883

    2021

  29. [38]

    Diffusion models beat gans on image synthesis,

    P. Dhariwal and A. Nichol, “Diffusion models beat gans on image synthesis,” Advances in neural information processing systems , vol. 34, pp. 8780–8794, 2021

    2021

  30. [39]

    Improved denoising diffusion probabilis- tic models,

    A. Q. Nichol and P. Dhariwal, “Improved denoising diffusion probabilis- tic models,” in International Conference on Machine Learning. PMLR, 2021, pp. 8162–8171

    2021

  31. [40]

    Dpm-solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps,

    C. Lu, Y . Zhou, F. Bao, J. Chen, C. Li, and J. Zhu, “Dpm-solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps,” Advances in Neural Information Processing Systems , vol. 35, pp. 5775–5787, 2022

    2022

  32. [41]

    Vector quantized diffusion model for text-to-image synthesis,

    S. Gu, D. Chen, J. Bao, F. Wen, B. Zhang, D. Chen, L. Yuan, and B. Guo, “Vector quantized diffusion model for text-to-image synthesis,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 10 696–10 706

    2022

  33. [42]

    Classifier-free diffusion guidance,

    J. Ho and T. Salimans, “Classifier-free diffusion guidance,” arXiv preprint arXiv:2207.12598, 2022

    2022 arXiv

  34. [43]

    Sdxl: Improving latent diffusion models for high-resolution image synthesis,

    D. Podell, Z. English, K. Lacey, A. Blattmann, T. Dockhorn, J. M ¨uller, J. Penna, and R. Rombach, “Sdxl: Improving latent diffusion models for high-resolution image synthesis,” 2023. [Online]. Available: https://arxiv.org/abs/2307.01952

    2023 arXiv

  35. [44]

    Edict: Exact diffusion inversion via coupled transformations,

    B. Wallace, A. Gokul, and N. Naik, “Edict: Exact diffusion inversion via coupled transformations,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2023, pp. 22 532–22 541

    2023

  36. [45]

    Exact diffusion inversion via bidirectional integration approximation,

    G. Zhang, J. P. Lewis, and W. B. Kleijn, “Exact diffusion inversion via bidirectional integration approximation,” in European Conference on Computer Vision . Springer, 2024, pp. 19–36

    2024

  37. [46]

    Prompt-to-prompt image editing with cross attention control,

    A. Hertz, R. Mokady, J. Tenenbaum, K. Aberman, Y . Pritch, and D. Cohen-Or, “Prompt-to-prompt image editing with cross attention control,” arXiv preprint arXiv:2208.01626 , 2022

    2022 arXiv

  38. [47]

    Null- text inversion for editing real images using guided diffusion models,

    R. Mokady, A. Hertz, K. Aberman, Y . Pritch, and D. Cohen-Or, “Null- text inversion for editing real images using guided diffusion models,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2023, pp. 6038–6047

    2023

  39. [48]

    Inversion-based style transfer with diffusion models,

    Y . Zhang, N. Huang, F. Tang, H. Huang, C. Ma, W. Dong, and C. Xu, “Inversion-based style transfer with diffusion models,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2023, pp. 10 146–10 156

    2023

  40. [49]

    Freecontrol: Training-free spatial control of any text-to-image diffusion model with any condition,

    S. Mo, F. Mu, K. H. Lin, Y . Liu, B. Guan, Y . Li, and B. Zhou, “Freecontrol: Training-free spatial control of any text-to-image diffusion model with any condition,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2024, pp. 7465–7475

    2024

  41. [50]

    Self-discovering interpretable diffusion latent directions for responsible text-to-image generation,

    H. Li, C. Shen, P. Torr, V . Tresp, and J. Gu, “Self-discovering interpretable diffusion latent directions for responsible text-to-image generation,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2024, pp. 12 006–12 016

    2024

  42. [51]

    Style injection in diffusion: A training-free approach for adapting large-scale diffusion models for style transfer,

    J. Chung, S. Hyun, and J.-P. Heo, “Style injection in diffusion: A training-free approach for adapting large-scale diffusion models for style transfer,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2024, pp. 8795–8805

    2024

  43. [52]

    A digital watermark,

    R. G. Van Schyndel, A. Z. Tirkel, and C. F. Osborne, “A digital watermark,” in Proceedings of 1st international conference on image processing, vol. 2. IEEE, 1994, pp. 86–90

    1994

  44. [53]

    A robust digital image watermarking method using wavelet-based fusion,

    D. Kundur and D. Hatzinakos, “A robust digital image watermarking method using wavelet-based fusion,” in Proceedings of International Conference on Image Processing , vol. 1. IEEE, 1997, pp. 544–547

    1997

  45. [54]

    Joint wavelet and spatial trans- formation for digital watermarking,

    M.-J. Tsai, K.-Y . Yu, and Y .-Z. Chen, “Joint wavelet and spatial trans- formation for digital watermarking,” IEEE Transactions on Consumer Electronics, vol. 46, no. 1, p. 237, 2000

    2000

  46. [55]

    Digital image watermarking for joint ownership,

    H. Guo and N. D. Georganas, “Digital image watermarking for joint ownership,” in Proceedings of the tenth ACM international conference on Multimedia, 2002, pp. 362–371

    2002

  47. [56]

    Reversible image watermarking based on integer-to-integer wavelet transform,

    S. Lee, C. D. Yoo, and T. Kalker, “Reversible image watermarking based on integer-to-integer wavelet transform,” IEEE Transactions on information forensics and security , vol. 2, no. 3, pp. 321–330, 2007

    2007

  48. [57]

    Combined dwt-dct digital image watermarking,

    A. Al-Haj, “Combined dwt-dct digital image watermarking,” Journal of computer science, vol. 3, no. 9, pp. 740–746, 2007

    2007

  49. [58]

    An application of multidimen- sional time-frequency analysis as a base for the unified watermarking approach,

    S. Stankovic, I. Orovic, and N. Zaric, “An application of multidimen- sional time-frequency analysis as a base for the unified watermarking approach,” IEEE Transactions on Image Processing , vol. 19, no. 3, pp. 736–745, 2009

    2009

  50. [59]

    Hybrid blind robust image watermarking technique based on dft-dct and arnold transform,

    M. Hamidi, M. E. Haziti, H. Cherifi, and M. E. Hassouni, “Hybrid blind robust image watermarking technique based on dft-dct and arnold transform,” Multimedia Tools and Applications , vol. 77, pp. 27 181– 27 214, 2018

    2018

  51. [60]

    Gradient-based learning applied to document recognition,

    Y . LeCun, L. Bottou, Y . Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE , vol. 86, no. 11, pp. 2278–2324, 1998

    1998

  52. [61]

    Attention is all you need,

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need,” Advances in neural information processing systems , vol. 30, 2017

    2017

  53. [62]

    Artificial fingerprinting for generative models: Rooting deepfake attribution in training data,

    N. Yu, V . Skripniuk, S. Abdelnabi, and M. Fritz, “Artificial fingerprinting for generative models: Rooting deepfake attribution in training data,” in Proceedings of the IEEE/CVF International conference on computer vision, 2021, pp. 14 448–14 457

    2021

  54. [63]

    Provably secure steganogra- phy,

    N. J. Hopper, J. Langford, and L. V on Ahn, “Provably secure steganogra- phy,” in Advances in Cryptology—CRYPTO 2002: 22nd Annual Interna- tional Cryptology Conference Santa Barbara, California, USA, August 18–22, 2002 Proceedings 22 . Springer, 2002, pp. 77–92

    2002

  55. [64]

    Distribution-preserving steganography based on text-to-speech genera- tive models,

    K. Chen, H. Zhou, H. Zhao, D. Chen, W. Zhang, and N. Yu, “Distribution-preserving steganography based on text-to-speech genera- tive models,” IEEE Transactions on Dependable and Secure Computing, vol. 19, no. 5, pp. 3343–3356, 2021

    2021

  56. [65]

    Provable secure steganography: Theory, application and prospects,

    W. Zhang, K. Chen, and N. Yu, “Provable secure steganography: Theory, application and prospects,” Journal of Cybersecurity, vol. 1, pp. 38–46, 2023

    2023

  57. [66]

    Ryan and S

    W. Ryan and S. Lin, Channel codes: classical and modern . Cambridge university press, 2009

    2009

  58. [67]

    Soft-decision decoding of linear block codes based on ordered statistics,

    M. P. Fossorier and S. Lin, “Soft-decision decoding of linear block codes based on ordered statistics,” IEEE Transactions on information Theory , vol. 41, no. 5, pp. 1379–1396, 2002

    2002

  59. [68]

    Towards a correct usage of cryptography in semantic watermarks for diffusion models,

    J. Thietke, A. M ¨uller, D. Lukovnikov, A. Fischer, and E. Quiring, “Towards a correct usage of cryptography in semantic watermarks for diffusion models,” arXiv preprint arXiv:2503.11404 , 2025

    2025 arXiv

  60. [69]

    Imagenet: A large-scale hierarchical image database,

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in 2009 IEEE conference on computer vision and pattern recognition . Ieee, 2009, pp. 248–255

    2009

  61. [70]

    Invisible image watermarks are prov- ably removable using generative ai,

    X. Zhao, K. Zhang, Z. Su, S. Vasan, I. Grishchenko, C. Kruegel, G. Vigna, Y .-X. Wang, and L. Li, “Invisible image watermarks are prov- ably removable using generative ai,” Advances in Neural Information Processing Systems, vol. 37, pp. 8643–8672, 2024

    2024

  62. [71]

    Gans trained by a two time-scale update rule converge to a local nash equilibrium,

    M. Heusel, H. Ramsauer, T. Unterthiner, B. Nessler, and S. Hochreiter, “Gans trained by a two time-scale update rule converge to a local nash equilibrium,” Advances in neural information processing systems , vol. 30, 2017

    2017

  63. [72]

    Learning transferable visual models from natural language supervision,

    A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark et al., “Learning transferable visual models from natural language supervision,” in International conference on machine learning . PMLR, 2021, pp. 8748–8763

    2021

  64. [73]

    Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models,

    P. Schramowski, M. Brack, B. Deiseroth, and K. Kersting, “Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 22 522–22 531

    2023

  65. [74]

    Waves: Benchmarking the robustness of image watermarks,

    B. An, M. Ding, T. Rabbani, A. Agrawal, Y . Xu, C. Deng, S. Zhu, A. Mohamed, Y . Wen, T. Goldstein et al. , “Waves: Benchmarking the robustness of image watermarks,” arXiv preprint arXiv:2401.08573, 2024. 18

    2024 arXiv

  66. [75]

    Microsoft coco: Common objects in context,

    T.-Y . Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Doll ´ar, and C. L. Zitnick, “Microsoft coco: Common objects in context,” in Computer Vision–ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13 . Springer,...

    2014

  67. [76]

    Reproducible scaling laws for contrastive language-image learning,

    M. Cherti, R. Beaumont, R. Wightman, M. Wortsman, G. Ilharco, C. Gordon, C. Schuhmann, L. Schmidt, and J. Jitsev, “Reproducible scaling laws for contrastive language-image learning,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp...

    2023

  68. [77]

    On the estimation of the discrepancy between empirical curves of distribution for two independent samples,

    N. V . Smirnov, “On the estimation of the discrepancy between empirical curves of distribution for two independent samples,” Bull. Math. Univ. Moscou, vol. 2, no. 2, pp. 3–14, 1939

    1939

  69. [78]

    An analysis of variance test for normality (complete samples),

    S. S. Shapiro and M. B. Wilk, “An analysis of variance test for normality (complete samples),” Biometrika, vol. 52, no. 3-4, pp. 591–611, 1965

    1965

  70. [79]

    On the distribution of the two-sample cramer-von mises criterion,

    T. W. Anderson, “On the distribution of the two-sample cramer-von mises criterion,” The Annals of Mathematical Statistics , pp. 1148–1159, 1962

    1962

  71. [80]

    A test for normality of observations and regression residuals,

    C. M. Jarque and A. K. Bera, “A test for normality of observations and regression residuals,” International Statistical Review/Revue Inter- nationale de Statistique , pp. 163–172, 1987

    1987

  72. [81]

    A suggestion for using powerful and informative tests of normality,

    R. B. D’agostino, A. Belanger, and R. B. D’Agostino Jr, “A suggestion for using powerful and informative tests of normality,” The American Statistician, vol. 44, no. 4, pp. 316–321, 1990

    1990

  73. [82]

    On a class of error correcting binary group codes,

    R. C. Bose and D. K. Ray-Chaudhuri, “On a class of error correcting binary group codes,” Information and control , vol. 3, no. 1, pp. 68–79, 1960

    1960

  74. [83]

    Ideal pseudorandom codes,

    O. Alrabiah, P. Ananth, M. Christ, Y . Dodis, and S. Gunn, “Ideal pseudorandom codes,” arXiv preprint arXiv:2411.05947 , 2024

    2024 arXiv

  75. [84]

    Gradient- free decoder inversion in latent diffusion models,

    S. Hong, S. Y . Jeon, K. Lee, E. Ryu, and S. Y . Chun, “Gradient- free decoder inversion in latent diffusion models,” Advances in Neural Information Processing Systems , vol. 37, pp. 82 982–83 007, 2024

    2024

  76. [2025]

    Available: https://arxiv.org/abs/2502.04901

    [Online]. Available: https://arxiv.org/abs/2502.04901

    arXiv

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.