Pith. sign in

REVIEW 3 major objections 5 minor 1 cited by

IConMark: Robust Interpretable Concept-Based Watermark For AI Images

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A visible-object watermark beats noise-based marks on AI images.

desk verdict IConMark is a genuinely new idea—semantic objects as watermarks—with credible results on benign edits, but its 'private' concept database is printed in the appendix, so the adversarial-robustness claim is untested. read the letter →

arxiv 2507.13407 v1 pith:EDHXNBNG submitted 2025-07-17 cs.CV cs.AIcs.CR

Vinu Sankar Sadasivan , Mehrdad Saberi , Soheil Feizi This is my paper · ORCID
classification cs.CVcs.AIcs.CR
keywords interpretablewatermarkingAIimageprovenanceconcept-basedwatermarkvision-languagemodelaugmentationrobustnessdiffusionpurificationprompt-basedembeddingdetection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

IConMark proposes that an AI-image watermark can be a set of ordinary-looking objects rather than an invisible noise pattern. Before generating an image, the method appends several concepts from a fixed database to the user's prompt, so the generator paints those objects into the scene; at detection time, a vision-language model is asked whether each database concept is present, and an image is marked as AI-generated if enough of them show up. The paper reports that this scheme, plus two hybrids that combine its verdict with StegaStamp or TrustMark, achieves mean AUROC gains of 10.8%, 14.5%, and 15.9% over the strongest noise-based baseline across affine, valuemetric, regeneration, and warp manipulations, and that IConMark variants are the only tested methods that stay accurate under all four. If correct, the work establishes interpretability as a robustness mechanism: a watermark a person can point to is also one that survives image edits.

What carries the argument

The machinery is a concept database plus a concept-count detection score. The database supplies the watermark alphabet; the top-k sampler selects contextually plausible entries from it; the image generator renders those concepts into the scene; and the vision-language model counts how many database concepts appear in a candidate image, with a threshold deciding the watermark verdict. This shifts the detection signal from low-amplitude noise, which diffusion purification and similar edits can erase, to semantic objects that remain recognizable after cropping, warping, color changes, and regeneration.

What would settle it

Remove or repaint all k embedded objects in a set of IConMark images using inpainting or targeted cropping, then rerun the IDEFICS3 detector; if AUROC at 5% false-positive rate falls to the level of the noise-based baselines, the robustness claim fails. Conversely, if ordinary real or non-watermarked AI images from the same generator accumulate enough database concepts to cross the threshold, the false-positive side of the claim fails.

Watch

Extended reading notes

Core claim

The central claim is that a watermark need not be a perturbation: it can be a set of concepts, describable objects with a distinctive detail such as 'a stone garden statue of buddha', inserted into the generated image by prompt augmentation. IConMark builds a private database of N=100 concepts, uses a language model to select k=9 related concepts for each user prompt, appends them to the prompt, and feeds the augmented prompt to the Flux image generator. At detection time, the vision-language model IDEFICS3 is asked to check for each database concept, and the number of concepts found is compared to a threshold: above threshold means watermarked. The paper shows detection AUROC rising from 76.05% at k=1 to 97.46% at k=9 on MS-COCO, with histograms of concept counts separating watermarked from non-watermarked images, and reports that under the tested augmentations IConMark, IConMark+TM, and IConMark+SS maintain high detection while noise-based baselines degrade substantially. In the paper's own summary, IConMark and its variants are the only techniques that maintain high detection in the presence of all of the augmentation attacks.

Load-bearing premise

Everything rests on the concept count actually separating watermarked from unwatermarked images: the generator must reliably paint the sampled concepts, the vision-language model must still recognize them after manipulation, and ordinary images must rarely contain enough database concepts by chance to cross the threshold.

Editorial extensions

If this is right

  • Detection is human-auditable: a person can verify a watermark by looking for database concepts, with no decoder or secret key needed.
  • Because IConMark only changes the prompt, it can be layered under any post-hoc watermarker; the hybrid's verdict is the OR of the two detectors, so it inherits both robustness sets.
  • Detection quality improves with the number of embedded concepts in the experiments, from 76.05 to 97.46 AUROC as k goes from 1 to 9 on MS-COCO, with reported generation-quality metrics roughly unchanged.
  • Across affine, valuemetric, regeneration, and warp modifications, IConMark and its hybrids are the only evaluated methods that maintain high detection accuracy; on average they beat StegaStamp by 10.8%, 14.5%, and 15.9% AUROC.
  • The method is a proof of concept that interpretable watermarks can complement, rather than replace, existing noise-based watermarking schemes.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Since the concept database is printed in the appendix, it is not actually secret: an attacker who knows the 100 concepts could try to add or scrub exactly those objects, so deployment would need a rotating or encrypted database to preserve security.
  • If semantic watermarks catch on, the attack surface shifts from pixel-space denoising to object-level editing, such as removing, repainting, or regenerating specific objects, so future detectors may need to check object relationships and location consistency, not just presence.
  • Because the watermark lives in the prompt, the same scheme could in principle transfer to newer image generators without retraining, as long as the generator reliably paints the requested concepts and the vision-language model reliably recognizes them.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes IConMark, a watermarking method for AI-generated images that samples k concepts from a hand-crafted concept database, augments the user prompt with these concepts, and later detects the watermark by prompting a vision-language model (IDEFICS3) to check for the presence of database concepts. The method is combined optionally with StegaStamp or TrustMark to form IConMark+SS and IConMark+TM. The experiments on MS-COCO and OIP datasets measure watermark detection AUROC, accuracy, true-positive rates at fixed false-positive rates, and image-quality metrics (CLIP score, aesthetic ratings, artifacts, diversity) under affine, valuemetric, regen (diffusion purification), and warp augmentations. The paper reports that IConMark and its variants achieve higher mean AUROC than the baseline methods and claims that IConMark is the first interpretable watermark, robust to adversarial manipulation and human-verifiable.

Significance. If the scope were limited to robustness against benign image manipulations and to machine-based watermark detection using semantic concepts, the paper would be a useful proof-of-concept: the augmentation evaluation is reasonably thorough, the hybrid combination logic is sensible, and the idea of embedding natural-language concepts is novel. However, the central security claim that IConMark is 'resilient to adversarial manipulation' is not supported by the evidence, because the so-called private concept database is printed verbatim in Appendix A.1, enabling an informed adversary to remove or spoof the watermark. The interpretability claim also lacks a human-subject evaluation. With a reframing of the claims and targeted additional experiments, the contribution could become a solid step toward semantic watermarking; in its current form, the adversarial-robustness framing overstates what is demonstrated.

major comments (3)
  1. [Sec. 3.1; Appendix A.1] The paper calls D a 'private concept database' (Sec. 3.1) and motivates resilience to adversarial manipulation on that basis (Abstract, Sec. 1), but the complete 100-concept list is printed verbatim in Appendix A.1. The secrecy assumption is therefore violated by the paper itself, and the evaluation in Sec. 5.3 considers only four oblivious augmentations (affine, valuemetric, regen, warp). A knowledgeable adversary could remove or inpaint known concepts or inject them into arbitrary images to spoof detection. The reported AUROC gains therefore do not support the adversarial-robustness claim; please either evaluate a knowledgeable adversary or explicitly scope the claim to benign image manipulations.
  2. [Sec. 1; Sec. 6] The paper claims IConMark is 'interpretable to humans' and enables 'manual verification of watermarks,' but no human-subject experiment is reported. The only evidence is that concepts are natural-language descriptions. Without measuring whether humans can distinguish watermarked from non-watermarked images, or reliably identify database concepts, the 'interpretable watermark' contribution is not substantiated. A small human study, or a clear statement that human interpretability is conjectural, is needed.
  3. [Sec. 3.3; Fig. 3; Table 3] The detection score is the number of database concepts that IDEFICS3 claims to see. Because watermarked images are generated by prompting Flux to insert exactly those concepts, high scores in the watermarked condition are expected by construction. The paper does not report per-concept false-positive rates or VLM precision, and Figure 3's histogram lacks labeled axes, making it hard to assess the true separation between classes. Moreover, the comparison to StegaStamp under augmentations is not attack-calibrated: the same perturbation may be much stronger for one watermark type than another. Please report per-concept detection statistics and an explicit false-positive analysis on a larger non-watermarked corpus.
minor comments (5)
  1. [Sec. 5.1] The sentence 'we halve our dataset size to 1080 images' is ambiguous: it is unclear whether 1080 is the total number of images or the number per class. Please clarify.
  2. [Abstract; Sec. 5.3] The phrase 'compared to the best baseline' is misleading: in Table 3, StegaStamp outperforms IConMark alone on OIP for regen (95.81 vs 86.34) and valuemetric (99.33 vs 83.43). The comparison appears to be against the best average baseline, StegaStamp; please state that explicitly.
  3. [Appendix A.1] The heading 'Additional Examples of Generated Images' is followed by the concept database and then more figures; give the concept database its own subsection title so that its presence is not buried.
  4. [References] Reference [16] (OpenAI ChatGPT) contains the placeholder 'Accessed: YYYY-MM-DD'; the access date should be completed.
  5. [Fig. 3] The right-hand histogram shows the number of detected concepts for watermarked and non-watermarked images, but the axes are unlabeled and the threshold τ is not marked. Adding axis labels and a threshold line would make the separation argument clearer.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: IConMark's detection pipeline is evaluated against external non-watermarked images and augmentations; the concept database is an input, not a fitted target.

full rationale

IConMark does not derive a prediction from a fitted parameter or from a self-citation chain. The watermarking protocol samples k concepts from the concept database D, appends them to the user prompt, generates watermarked images with Flux, and detects by counting how many D-concepts the IDEFICS3 VLM reports in a candidate image (Sections 3.2 and 3.3). The separation between watermarked and non-watermarked classes is an empirical outcome, not an algebraic identity: positive images are generated with the concepts inserted, while negative images are generated without them, and the AUROC measures whether the VLM's detections actually separate these externally constructed classes (Section 5.2, Figure 3, Table 3). No detection threshold is fit to the reported AUROC; ROC curves are computed over the full threshold sweep, and the false-positive rate is measured on non-watermarked Flux images, which are independent of the embedding. The robustness results (Section 5.3) test the same detector against affine, valuemetric, warp, and regeneration transformations, none of which is used to tune a parameter of IConMark. Self-citations to [18] and [20] are background claims about watermark vulnerability and AI-content detection limits; they do not constitute the load-bearing derivation of IConMark's mechanism or its empirical gains. The fact that the 'private' concept database is printed in Appendix A.1 undermines the secrecy assumption for adversarial spoofing or removal and is a genuine security limitation, but it is not circularity: the public listing does not make detection accuracy equal to the construction by definition. Similarly, the claimed human interpretability is not backed by a human study, but absence of evidence is a correctness risk, not a circular step.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claims rest on the reliability of the component models (generator and VLM), the separability of the hand-crafted concept database, and the adequacy of the quality metrics. These are domain assumptions rather than mathematical axioms; there are no invented entities such as new particles or forces. The concept database is an artifact but not an invented scientific entity.

free parameters (4)
  • k (number of concepts sampled) = 9
    Chosen based on detection performance vs. quality trade-off (Tables 1 and 2); the paper fixes k=9 for main experiments. Different k yields different AUROC, so the chosen value is a fitted parameter.
  • Concept database D (set of 100 concepts) = 100 hand-crafted concepts
    The database is generated via ChatGPT and manually curated; its content determines the false-positive rate and the detectability of the watermark. It is effectively a free design parameter, not derived from theory.
  • Detection threshold tau = not specified as a fixed value; swept for ROC
    The threshold on the concept-count score is varied to produce ROC curves. No single tau is recommended for deployment, and the paper does not study how tau should be set in practice.
  • N (concept database size) = 100
    Chosen by the authors; no analysis of sensitivity to N is provided.
assumptions (5)
  • domain assumption The image generator G (Flux) inserts all sampled concepts into the generated image when prompted.
    Section 3.2 assumes that the augmented prompt leads to faithful inclusion of concepts; if the generator omits or modifies some concepts, the detection score drops.
  • domain assumption The visual language model V (IDEFICS3) can accurately determine the presence of each of the 100 concepts in an image, including after augmentations.
    Section 3.3 relies on V's yes/no responses; its accuracy is not independently evaluated, yet the whole detection mechanism depends on it.
  • domain assumption Non-watermarked images rarely contain many concepts from the database.
    The ROC separation in Figure 3 depends on this; the database includes very common objects (e.g., 'a fluffy white cloud', 'a crescent moon shape'), which may appear naturally in ordinary images.
  • domain assumption The image quality metrics (CLIP score, aesthetic ratings, artifacts) capture the relevant effect of watermarking on image quality.
    Section 5.1 uses these metrics but they do not measure semantic deviation from the user's intended prompt, which is the main practical concern for a method that adds objects to images.
  • ad hoc to paper The attack model is limited to the four augmentations (affine, valuemetric, regen, warp); a knowledgeable adversary is out of scope.
    The paper claims resilience to adversarial manipulation but only tests generic augmentations, not attacks that know the concept database. This assumption is implicit and not stated as a limitation in the main text.

how reviews work

0 comments
Cite this review

Pith. "Pith review of IConMark: Robust Interpretable Concept-Based Watermark For AI Images." pith.science (2026). https://pith.science/paper/EDHXNBNG

@misc{pith2026250713407,
  author       = {Pith},
  title        = {Pith review of: IConMark: Robust Interpretable Concept-Based Watermark For AI Images},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EDHXNBNG}},
  note         = {Machine review of arXiv:2507.13407}
}
read the original abstract

With the rapid rise of generative AI and synthetic media, distinguishing AI-generated images from real ones has become crucial in safeguarding against misinformation and ensuring digital authenticity. Traditional watermarking techniques have shown vulnerabilities to adversarial attacks, undermining their effectiveness in the presence of attackers. We propose IConMark, a novel in-generation robust semantic watermarking method that embeds interpretable concepts into AI-generated images, as a first step toward interpretable watermarking. Unlike traditional methods, which rely on adding noise or perturbations to AI-generated images, IConMark incorporates meaningful semantic attributes, making it interpretable to humans and hence, resilient to adversarial manipulation. This method is not only robust against various image augmentations but also human-readable, enabling manual verification of watermarks. We demonstrate a detailed evaluation of IConMark's effectiveness, demonstrating its superiority in terms of detection accuracy and maintaining image quality. Moreover, IConMark can be combined with existing watermarking techniques to further enhance and complement its robustness. We introduce IConMark+SS and IConMark+TM, hybrid approaches combining IConMark with StegaStamp and TrustMark, respectively, to further bolster robustness against multiple types of image manipulations. Our base watermarking technique (IConMark) and its variants (+TM and +SS) achieve 10.8%, 14.5%, and 15.9% higher mean area under the receiver operating characteristic curve (AUROC) scores for watermark detection, respectively, compared to the best baseline on various datasets.

Figures

Figures reproduced from arXiv: 2507.13407 by the authors.

Figure 1
Figure 1. Watermark generation (top) and detection (bottom) pipeline for IConMark (and variants). Various concepts are generated [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Illustration of images generated by the Flux model and IConMark for different values of [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. (Left) ROC curves for ablations of k for our proposed method IConMark. The black dashed lines indicate the ROC curve of a random detector. (Right) Number of concepts detected in watermarked (IConMark k = 9) and non-watermarked images by the IDEFICS3 visual language model. (a) Affine (b) Regen (c) Valuemetric (d) Warp [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (9 more)
Figure 4
Figure 4. Figure 4: ROC curves of various watermarking techniques in the presence of various image augmentations with the MS-COCO dataset. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Comparing images generated with different watermarking techniques. The images in the first column are non-watermarked [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]
Figure 6
Figure 6. Figure 6: Non-watermarked images with their corresponding prompts for image generation using the Flux model. [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]
Figure 7
Figure 7. Figure 7: IConMark watermarked images (k = 1) with their corresponding prompts for image generation using the Flux model and detected concepts from the concept database D using the IDEFICS3 visual language model. 13 [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]
Figure 8
Figure 8. Figure 8: IConMark watermarked images (k = 3) with their corresponding prompts for image generation using the Flux model and detected concepts from the concept database D using the IDEFICS3 visual language model. 14 [PITH_FULL_IMAGE:figures/full_fig_p014_8.png]
Figure 9
Figure 9. Figure 9: IConMark watermarked images (k = 5) with their corresponding prompts for image generation using the Flux model and detected concepts from the concept database D using the IDEFICS3 visual language model. 15 [PITH_FULL_IMAGE:figures/full_fig_p015_9.png]
Figure 10
Figure 10. Figure 10: IConMark watermarked images (k = 7) with their corresponding prompts for image generation using the Flux model and detected concepts from the concept database D using the IDEFICS3 visual language model. 16 [PITH_FULL_IMAGE:figures/full_fig_p016_10.png]
Figure 11
Figure 11. Figure 11: IConMark watermarked images (k = 9) with their corresponding prompts for image generation using the Flux model and detected concepts from the concept database D using the IDEFICS3 visual language model. 17 [PITH_FULL_IMAGE:figures/full_fig_p017_11.png]
Figure 12
Figure 12. Figure 12: Examples of modified images for each modification type used in Section [PITH_FULL_IMAGE:figures/full_fig_p018_12.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. First-Place Solution to NeurIPS 2024 Invisible Watermark Removal Challenge

    cs.CV 2025-08 conditional novelty 4.0 of 10

    A competition-winning pipeline removes 95.7% of StegaStamp and TreeRing watermarks on the NeurIPS 2024 benchmark by combining VAE fine-tuning, diffusion purification, and translation tricks.

Reference graph

Works this paper leans on

120 extracted references · 69 canonical work pages · cited by 1 Pith paper

  1. [1]

    Combined dwt-dct digital image water- marking

    Ali Al-Haj. Combined dwt-dct digital image water- marking. Journal of computer science, 3(9):740–746,

  2. [2]

    Benchmarking the robustness of image watermarks

    Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Gold- stein, et al. Benchmarking the robustness of image watermarks. arXiv preprint arXiv:2401.08573, 2024. 3, 4, 8

    arXiv 2024

  3. [3]

    Consistency-diversity-realism pareto fronts of con- ditional image generative models

    Pietro Astolfi, Marlene Careil, Melissa Hall, Os- car Ma ˜nas, Matthew Muckley, Jakob Verbeek, Adriana Romero Soriano, and Michal Drozdzal. Consistency-diversity-realism pareto fronts of con- ditional image generative models. arXiv preprint arXiv:2406.10429, 2024. 8

    arXiv 2024

  4. [4]

    Trust- mark: Universal watermarking for arbitrary resolution images

    Tu Bui, Shruti Agarwal, and John Collomosse. Trust- mark: Universal watermarking for arbitrary resolution images. arXiv preprint arXiv:2311.18297, 2023. 1, 2, 4, 12

    arXiv 2023

  5. [5]

    Securing the future of genai: Policy and technology

    Mihai Christodorescu, Ryan Craven, Soheil Feizi, Neil Gong, Mia Hoffmann, Somesh Jha, Zhengyuan Jiang, Mehrdad Saberi Kamarposhti, John Mitchell, Jessica Newman, et al. Securing the future of genai: Policy and technology. arXiv preprint arXiv:2407.12999, 2024. 1

    arXiv 2024

  6. [6]

    Digital Watermarking and Steganography

    Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker. Digital Watermarking and Steganography. Morgan Kaufmann Publishers Inc., San Francisco, CA, USA, 2 edition, 2007. 1, 2, 4, 12

    2007

  7. [7]

    The llama 3 herd of models

    Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21783, 2024. 7

    arXiv 2024

  8. [8]

    The stable signa- ture: Rooting watermarks in latent diffusion models,

    Pierre Fernandez, Guillaume Couairon, Herv ´e J´egou, Matthijs Douze, and Teddy Furon. The stable signa- ture: Rooting watermarks in latent diffusion models,

Show all 120 references
  1. [9]

    An undetectable watermark for generative image models

    Sam Gunn, Xuandong Zhao, and Dawn Song. An undetectable watermark for generative image models. arXiv preprint arXiv:2410.07369, 2024. 1

    2024 arXiv

  2. [10]

    Artificial intelligence, deepfakes, and disinformation

    Todd C Helmus. Artificial intelligence, deepfakes, and disinformation. RAND Corporation, pages 1–24,

  3. [11]

    Clipscore: A reference- free evaluation metric for image captioning

    Jack Hessel, Ari Holtzman, Maxwell Forbes, Ro- nan Le Bras, and Yejin Choi. Clipscore: A reference- free evaluation metric for image captioning. arXiv preprint arXiv:2104.08718, 2021. 8

    2021 arXiv

  4. [12]

    Digital watermarking

    Chris Honsinger. Digital watermarking. Journal of Electronic Imaging, 11(3):414, 2002. 2

    2002

  5. [13]

    Black Forest Labs. Flux. https://github.com/ black-forest-labs/flux, 2024. 7

    2024

  6. [14]

    Building and better understanding vision-language models: insights and future direc- tions

    Hugo Laurenc ¸on, Andr´es Marafioti, Victor Sanh, and L´eo Tronchon. Building and better understanding vision-language models: insights and future direc- tions. In Workshop on Responsibly Building the Next Generation of Multimodal Foundational Models,

  7. [15]

    Microsoft coco: Com- mon objects in context

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll ´ar, and C Lawrence Zitnick. Microsoft coco: Com- mon objects in context. In Computer Vision–ECCV 2014: 13th European Conference, Zurich, Switzer- land, September 6-12, 2014, Proce...

    2014

  8. [16]

    Chatgpt: An ai language model, 2023

    OpenAI. Chatgpt: An ai language model, 2023. Ac- cessed: YYYY-MM-DD. 3

    2023

  9. [17]

    Learning transferable visual models from natural language supervision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sas- try, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, ...

    2021

  10. [18]

    Robustness of ai-image detec- tors: Fundamental limits and practical attacks

    Mehrdad Saberi, Vinu Sankar Sadasivan, Keivan Rezaei, Aounon Kumar, Atoosa Chegini, Wenxiao Wang, and Soheil Feizi. Robustness of ai-image detec- tors: Fundamental limits and practical attacks. arXiv preprint arXiv:2310.00076, 2023. 1, 2, 3, 4, 8

    arXiv

  11. [19]

    Drew: Towards robust data provenance by leverag- ing error-controlled watermarking

    Mehrdad Saberi, Vinu Sankar Sadasivan, Ar- man Zarei, Hessam Mahdavifar, and Soheil Feizi. Drew: Towards robust data provenance by leverag- ing error-controlled watermarking. arXiv preprint arXiv:2406.02836, 2024. 1

    2024 arXiv

  12. [20]

    Can ai-generated text be reliably detected? arXiv preprint arXiv:2303.11156, 2023

    Vinu Sankar Sadasivan, Aounon Kumar, Sriram Bal- asubramanian, Wenxiao Wang, and Soheil Feizi. Can ai-generated text be reliably detected? arXiv preprint arXiv:2303.11156, 2023. 3, 8 9

    2023 arXiv

  13. [21]

    Watermark anything with localized messages

    Tom Sander, Pierre Fernandez, Alain Durmus, Teddy Furon, and Matthijs Douze. Watermark anything with localized messages. arXiv preprint arXiv:2411.07231,

    arXiv

  14. [22]

    Multimedia data-embedding and watermark- ing technologies

    Mitchell D Swanson, Mei Kobayashi, and Ahmed H Tewfik. Multimedia data-embedding and watermark- ing technologies. Proceedings of the IEEE , 86(6): 1064–1087, 1998. 2

    1998

  15. [23]

    Stegastamp: Invisible hyperlinks in physical pho- tographs

    Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical pho- tographs. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 2117–2126, 2020. 1, 2, 4, 12

    2020

  16. [24]

    Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust

    Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust. arXiv preprint arXiv:2305.20030, 2023. 1, 3, 4

    2023 arXiv

  17. [25]

    Imagereward: Learning and evaluating human prefer- ences for text-to-image generation

    Jiazheng Xu, Xiao Liu, Yuchen Wu, Yuxuan Tong, Qinkai Li, Ming Ding, Jie Tang, and Yuxiao Dong. Imagereward: Learning and evaluating human prefer- ences for text-to-image generation. Advances in Neu- ral Information Processing Systems, 36, 2024. 8

    2024

  18. [26]

    Can simple averaging defeat modern watermarks?Ad- vances in Neural Information Processing Systems, 37: 56644–56673, 2024

    Pei Yang, Hai Ci, Yiren Song, and Mike Zheng Shou. Can simple averaging defeat modern watermarks?Ad- vances in Neural Information Processing Systems, 37: 56644–56673, 2024. 3

    2024

  19. [27]

    Gaussian shading: Provable performance-lossless image watermarking for diffusion models

    Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shading: Provable performance-lossless image watermarking for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogni- tion, pages 12162–12171, 2024...

    2024

  20. [28]

    a worn blue leather armchair

  21. [29]

    a stack of old orange books

  22. [30]

    a white vintage typewriter

  23. [31]

    a red brick fireplace

  24. [32]

    a patterned green persian rug

  25. [33]

    a red wooden grandfather clock

  26. [34]

    a collection of vinyl records in blue

  27. [35]

    a stone garden statue of buddha

  28. [36]

    a bright pink colored beach umbrella

  29. [37]

    a metal blue street sign

  30. [38]

    a yellow public phone booth

  31. [39]

    a smooth river rock next to a pebble

  32. [40]

    a patch of colorful purple wildflowers

  33. [41]

    a heap of fallen autumn leaves

  34. [42]

    a bird’s nest with eggs

  35. [43]

    a moss-covered tree trunk with a hole

  36. [44]

    a rocky mountain with a green top

  37. [45]

    a fluffy white cloud

  38. [46]

    a crescent moon shape with two stars next to it

  39. [47]

    a yellow hot air balloon

  40. [48]

    a sailboat on the horizon

  41. [49]

    a piece of floating green seaweed

  42. [50]

    a rusted ship’s anchor

  43. [51]

    a beachside lifeguard tower

  44. [52]

    a calm lake reflection

  45. [53]

    a volley of seashells

  46. [54]

    a distant planet’s red ring

  47. [55]

    a cratered moon surface

  48. [56]

    a rocket ship’s engines

  49. [57]

    a comet’s tail with two stars next to it

  50. [58]

    a magical yellow crystal ball

  51. [59]

    a mythical dragon statue

  52. [60]

    a fantasy castle tower

  53. [61]

    a futuristic robot arm

  54. [62]

    a mythical unicorn horn

  55. [63]

    a vintage sewing machine

  56. [64]

    a blue wooden picture frame

  57. [65]

    a beautifully crafted black music box

  58. [66]

    a stack of old red suitcases

  59. [67]

    a bright yellow colored food cart

  60. [68]

    a city street performer’s tip jar with coins

  61. [69]

    a park’s walking trail sign in green color

  62. [70]

    a garden’s stone pathway

  63. [71]

    a green beach volleyball

  64. [72]

    a parking meter in black color

  65. [73]

    a street artist’s canvas of a portrait

  66. [74]

    a forest waterfall at distance

  67. [75]

    a field of tall sunflowers

  68. [76]

    a desert cactus spine with blue spots

  69. [77]

    a mountain hiking trail with puddles

  70. [78]

    a red fire extinguisher

  71. [79]

    a green wooden boat oar

  72. [80]

    a stack of old newspapers with a mug on top of it

  73. [81]

    a beautifully crafted brown wooden flute

  74. [82]

    a small potted cactus with red spots

  75. [83]

    a woven basket with blueberries

  76. [84]

    a red metal lantern post

  77. [85]

    a set of orange gardening gloves

  78. [86]

    a beautifully crafted blue wooden birdhouse

  79. [87]

    a circular metal street grate

  80. [88]

    a beautifully crafted stone fountain

  81. [89]

    a beautifully crafted yellow wooden rocking chair

  82. [90]

    a medieval castle wall with ferns on it

  83. [91]

    a dark and spooky cave with dead trees around it

  84. [92]

    a wooden treasure chest with gold

  85. [93]

    a metal astronaut’s helmet

  86. [94]

    a metal submarine’s propeller

  87. [95]

    a red colored party hat

  88. [96]

    a shiny copper kettle

  89. [97]

    a beautifully crafted wooden carousel horse

  90. [98]

    a vintage copper microscope

  91. [99]

    a worn wooden baseball bat with a blue grip

  92. [100]

    a bright orange construction cone

  93. [101]

    a small potted bonsai tree with pink and blue flowers

  94. [102]

    a vintage red fire truck toy

  95. [103]

    a beautifully crafted wooden model ship in blue color

  96. [104]

    a set of red vintage postcards

  97. [105]

    a vintage black and white television with an antenna

  98. [106]

    a set of antique binoculars in brown color

  99. [107]

    a beautifully crafted circular wooden wall mirror

  100. [108]

    a beautifully crafted crystal decanter half-filled with wine

  101. [109]

    a vintage black and white photograph of a landscape

  102. [110]

    a brown wooden walking stick with a silver handle

  103. [111]

    a set of fine silver picture frames with engravings

  104. [112]

    a vintage astronomical globe

  105. [113]

    a beautifully crafted wooden abacus

  106. [114]

    a vintage metal harmonium

  107. [115]

    a small potted venus flytrap plant

  108. [116]

    a vintage blue leather-bound journal

  109. [117]

    a beautifully crafted wooden model of the eiffel tower

  110. [118]

    a set of blue and white striped candy canes

  111. [119]

    a beautifully crafted stone inca statue

  112. [120]

    A view from a window on board an airplane flying in the sky

    a red acoustic guitar 11 (a) IConMark generation for various numbers of selected concepts k. (b) Comparing images with various watermarking techniques. Figure 5. Comparing images generated with different watermarking techniques. The images in the first column are non-watermark...

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.