IRIS: Visual-Semantic Binding for Forgery-Resistant Watermarking of Diffusion Images

Bokang Zeng; Jiaojiao Jiang; Rui Bao; Tong Guan; Xiaoyan Feng; Xiaoyu Li; Zheng Gao

REVIEW 3 major objections 4 minor 37 references

IRIS: Visual-Semantic Binding for Forgery-Resistant Watermarking of Diffusion Images

T0 review · 3 major / 4 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read IRIS claims a training-free watermark that binds a one-time phase ring to a generated image's visual semantics, so verification recomputes the mark from the image and key alone and forgery fails.

desk verdict IRIS is a genuinely new and cleanly engineered in-generation watermark, but the forgery-resistance headline rests on an uncharacterized collision cone and an untested same-prompt transplant. read the letter →

arxiv 2608.03539 v1 pith:G2WGDL37 submitted 2026-08-04 cs.CV

Xiaoyan Feng , Zheng Gao , Tong Guan , Rui Bao , Bokang Zeng , Xiaoyu Li , Jiaojiao Jiang This is my paper · ORCID

classification cs.CV

keywords diffusionimagewatermarkingvisual-semanticbindingforgeryresistanceDDIMinversionphase-ringwatermarkCLIPembeddingSimHashregenerationremoval

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that a watermark for diffusion-generated images can be bound to the visual meaning of the image it protects, so a mark transplanted onto different content no longer verifies. It claims that this binding can be done inside generation without training: derive a one-time phase ring from a keyed hash of the canonicalized CLIP embedding of the clean generated image, then blend it into the late, low-noise steps of the same sampling trajectory. Because detection recomputes the ring from the query image and the secret key alone, a forged or spliced image derives a different ring and fails verification, while common distortions and mild regeneration are absorbed by canonicalization and a candidate set. The paper reports that IRIS detects at TPR 0.99 with 1% false positive rate, keeps PSNR 30.2 and SSIM 0.92 against its same-seed non-watermarked counterpart, and holds the lowest attack success rate across reprompt, PGD forgery, regeneration, and PGD removal among the compared marks. The broader reason to care: if true, content provenance can be verified statelessly from the image itself, making forgery of AI-generated images measurably harder.

What carries the argument

The intrinsic ring identifier: a one-time, phase-only Fourier ring on a narrow mid-frequency annulus, derived from the image's canonicalized CLIP embedding through keyed SimHash, HMAC, and a PRNG, and blended into the last ten DDIM steps of the same trajectory. It carries the argument because it makes the mark recomputable from the image plus key at detection, while any semantic change shifts the embedding, changes the code, and yields a different ring, so the mark fails exactly when visual meaning moves.

What would settle it

Run an adaptive search over generated or adversarially perturbed images to find, for each released watermarked image, a semantically distinct image whose canonicalized CLIP embedding hashes to a code within the candidate set (Hamming radius 3 or the 7 low-margin flips), then submit it to verification; if a substantial fraction pass at the 1% FPR threshold, the binding claim collapses. The paper's own concession about the uncharacterized adaptive search is exactly the test to run.

Watch

Extended reading notes

Core claim

The central claim is that the watermark can be intrinsic to the image's semantics rather than an independent pattern. IRIS reads the clean endpoint image through a canonicalization (luminance normalization, heavy blur, low-quality JPEG, and averaging over re-degraded copies), quantizes its CLIP embedding with a keyed SimHash into a 24-bit content code, hashes the code with HMAC into a seed, and expands the seed into a Hermitian phase ring on a narrow mid-frequency annulus of one latent channel. It then replays only the final ten DDIM steps, blending the ring in with energy matched to the band's own spectrum and a decaying weight, so the semantics the mark binds to are already settled. At ver

Load-bearing premise

The scheme's forgery resistance rests on it being genuinely hard to find a semantically different image whose keyed SimHash code still lands in the candidate set; the paper states this search cost is uncharacterized, so if such collisions are easy to find, the mark can be forged despite its semantic binding.

Editorial extensions

If this is right

If IRIS works as claimed, in-generation watermarks no longer have to trade fidelity for robustness: the mark can preserve the generated content (PSNR 30.2 vs baselines at 14.4 or below) while surviving regeneration.
Verification is blind and stateless—only the image and the secret key are needed—so no per-image prompt, seed, latent, or external record has to be stored or transmitted.
Forgery resistance becomes tied to how far an attacker must move an image's semantics to find a code collision; the acceptance-cone angle is a measurable security parameter that can be capped by tuning the candidate set.
The design extends naturally to any deterministic invertible sampler, including flow-based samplers, not just DDIM.
Post-hoc marks remain removable by regeneration, but a semantically bound late-step ring is not, because the ring sits in a band that redrawn detail leaves largely untouched.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The security guarantee is only as strong as the uncharacterized search cost for a semantic collision; an adaptive attacker who optimizes over CLIP embedding space or generated variants to land inside the candidate set could forge the mark without recovering the key. The paper itself flags this, so I read the contribution as establishing the binding mechanism and its non-adaptive resistance, not a
Because the semantic axis is CLIP, the scheme inherits CLIP's blind spots: an adversarial perturbation that preserves human-visible content but moves the CLIP embedding could either push a legitimate image out of the cone or, in principle, pull an attacker-chosen image in. A direct test would attack the code-reading stage with a small perturbation search.
The acceptance-cone size is explicitly controlled by the candidate-set radius and low-margin bit count; deployment could tune the mark's sensitivity to a target semantic-displacement threshold, at the cost of opening a larger forgery window.
A stronger canonicalization or a perceptual encoder trained for value-metric invariance might widen the retained range, as the paper suggests, but it could also widen the cone to semantic changes—so that extension is not guaranteed to preserve the binding sharpness.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The core idea is real. IRIS derives the watermark from the canonicalized CLIP embedding of the delivered image at the end of the trajectory, then replays a phase ring into the late DDIM steps. That late-injection trick is the right fix for the causal entanglement problem. It is training-free, blind, stateless, and reasonably cheap. The paper is also refreshingly honest: Section 5.2 explicitly names the adaptive collision search as uncharacterized and proposes its cost as the security notion. The ablation study (candidate set, t0, canonicalization) is thorough, and the code-survival/ring-survival decomposition shows the mechanism actually works as described.

Fidelity is the strongest part. PSNR 30.2 with SSIM 0.92 against the same-seed counterpart is a real improvement over the in-generation baselines that redraw the image. The robustness results under JPEG, blur, noise, and geometric distortions are plausible and well documented.

The soft spot is exactly where the paper says it is: the acceptance cone. The whole security argument is that a forged image's recomputed code lands outside the candidate set C(ĉ). But the paper never measures how hard it is to find an image inside that cone that is semantically distinct, and it does not test the simplest attack that exploits the cone's width: same-prompt, different-seed regeneration with a transplanted ring. The stress-test note is right—the adversary reads the ring from the public image via inversion, regenerates under a near-identical prompt, and replays the ring at t0. The recomputed code for the new image is likely within the roughly 23° half-acceptance angle, so the detector would test the original ring and probably accept. That is precisely the "forgery" the paper claims to resist, and Section 5.2's PGD and reprompt attacks never approach it. The paper's own numbers (θ50 ≈ 23°, two unrelated images ≈ 49° apart) show the cone spans a large part of the semantic neighbourhood.

A second concern, minor relative to the above: the hyperparameters (band radius, α0, t0, r, L) are selected on the same datasets used for evaluation, with no held-out split. No code is released, which makes the security question harder to resolve by replication.

My verdict: the engineering is solid and the description of the mechanism is honest, but the headline claim "resists forgery" is not yet supported. The paper needs a security analysis of the candidate-cone collision problem and, at minimum, an evaluation of the same-prompt ring-transfer attack. This is a good candidate for peer review—send it to referees with instructions to focus on Section 5.2 and the cone width—but I would not cite it as a forgery-resistant scheme until that is addressed.

Referee Report

3 major / 4 minor

Summary. The paper proposes IRIS, a training-free in-generation watermark for diffusion images that binds the mark to the visual semantics of the delivered image. During generation, IRIS first produces the clean image, reads a keyed 24-bit SimHash content code from a canonicalized CLIP embedding, derives a one-time phase-only ring in a mid-frequency Fourier band (16,20] of latent channel 0, and replays the last 10 DDIM steps (t0=40) with the ring blended in at a strength matched to the band energy. Detection recomputes the code from the query image, expands it to a candidate set of Hamming ball radius 3 plus 7 low-margin-bit flips, and runs a matched filter over the corresponding candidate rings after DDIM inversion. The paper reports TPR 0.99 at 1% FPR, PSNR 30.2 / SSIM 0.92 versus the same-seed non-watermarked counterpart, robustness to JPEG/blur/noise/brightness/crop/rotation, and the lowest mean ASR (0.04) across reprompt, PGD forgery, regeneration, and PGD removal when compared with Tree-Ring, Gaussian Shading, SEAL, Stable Signature, and DwtDctSvd. The paper explicitly concedes in Section 5.2 that an adaptive search for a semantically distinct image whose code still lands in the candidate set is uncharacterized.

Significance. If the security claim holds, the paper is a meaningful advance: it demonstrates a blind, stateless, training-free watermark that survives regeneration while resisting the tested transplantation attacks, and it improves same-seed fidelity by an order of magnitude in PSNR over the in-generation baselines. The experimental work is detailed and internally consistent, and the framing of the acceptance cone as the security parameter is a useful contribution to the content-bound watermarking literature. However, the central forgery-resistance claim rests on an uncharacterized collision assumption: that an adversary cannot find a semantically distinct image whose recomputed code falls inside the candidate set. The paper's own Figure 4 shows that the observed band (oracle code) survives replacement nearly unchanged, so the binding is enforced entirely by the code readout; any image whose code lands in C(ĉ) inherits the embedded ring. The submitted experiments do not quantify the distance of same-prompt different-seed images on the CLIP angle axis, which is precisely the regime the candidate set is designed to tolerate. This gap is load-bearing for the headline security claim.

major comments (3)

[§5.2 / Eq. (6)] The paper concedes that 'an adaptive search for a semantically distinct image whose code still lands in the candidate set remains uncharacterized.' This is not a peripheral limitation: it is the security property. A concrete untested attack is the same-prompt ring-transfer: take a released watermarked image, extract the band (16,20] phases via DDIM inversion (§4.2), generate a new image from the same prompt with a different seed, invert it to t0=40, and blend the extracted phases with the schedule of Eq. (4). Because the new image is semantically close to the original, its canonicalized CLIP embedding may fall within the half-acceptance angle θ50≈23° reported in Fig. 4(b), so the recomputed code lands in C(ĉ). The detector would then test the original ring and, given the oracle-code ring survival shown in Fig. 4(a), would likely accept. This attack is squarely within the threat model (al
[§5.2 / Fig. 4(a)] The evidence that 'the code does the letting go' is partly by construction, since detection recomputes the code from the query and a drifted code maps through HMAC to an unrelated ring. More important, Fig. 4(a) shows that ring survival with the oracle code stays nearly unchanged under content replacement; this means the band itself is reusable if the code can be kept in the cone. The security question is not whether arbitrary edited images drift out of C(ĉ), but whether an adversary can efficiently find a semantically distinct image that does not. The current protocol-level observation that code survival overlaps TPR does not address adversarial optimization toward the cone. I would like to see a measurement of the distribution of CLIP angles for same-prompt different-seed generations and for small prompt perturbations (e.g., synonym or attribute changes), and the resulting TPR/ASR when
[§5.4 / Fig. 7] The candidate-set ablation quantifies how r and L trade off against cone width (4° per radius step, ~1° per bit), but it does not connect this to the actual attack surface. The deployed r=3, L=7 yields θ50≈23°, while unrelated generated images are reported to sit about 49° apart. Same-prompt different-seed images will plausibly sit far below 49°, possibly below 23°, yet this quantity is never reported. Without this number, the 'deployed pair sits at the joint knee' statement is only a robustness-coverage trade-off, not a security calibration. The paper should report the same-prompt/slightly-edited CLIP-angle distribution and, if it overlaps the cone, adjust the candidate set or the threat model accordingly.

minor comments (4)

[§5.1 / Table 1] The claim 'IRIS alone among the compared marks withstands both forgery and regeneration' is supported by the mean ASR column, but the PGD removal ASR of 0.09 is nonzero; the wording could be sharpened to 'lowest mean ASR' or 'below 0.10 on all four attacks' to match the data.
[§5.3 / Fig. 5] The rotation experiment searches a grid of candidate angles and applies the same search to non-watermarked images. It would be helpful to state the grid resolution and the range searched, since the TPR curve's flatness depends on that search density.
[§5.4 / Fig. 7] The sentence 'the margin subsets are few and half of them lie inside the ball' is unclear: a subset count is not given, and it is not obvious which 'half' is meant. Clarify the overlap statistic.
[Abstract/§5.1] The phrase 'from the same seed' is used for IRIS's fidelity comparison, but for Tree-Ring the same-seed counterpart is 'verified bit-identical before injection' and then modified; the caption of Table 1 could state explicitly whether all same-seed comparisons hold the initial latent fixed before each mark's injection.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: IRIS's content-dependent acceptance is by design, but its central security and fidelity claims rest on independent empirical comparisons against external baselines.

full rationale

The paper's derivation chain is self-contained: the ring is derived from the canonicalized CLIP embedding of the generated image via a keyed SimHash and HMAC, blended into late DDIM steps, and recomputed at detection from the query image. It is true by construction that acceptance tracks code drift, since the detector derives the ring from the recomputed code and compares it to the observed band. Section 5.2's overlap between code survival and TPR is therefore an expected consequence of the protocol, not an independent empirical law. However, the paper does not present this overlap as a surprising discovery; it uses it to explain the mechanism. The main claims—IRIS alone among compared marks withstands both forgery and regeneration, with given TPR/PSNR/SSIM/ASR values—are empirical results against standard baselines (Tree-Ring, Gaussian Shading, SEAL, Stable Signature, DwtDctSvd) under concrete attacks (reprompt, PGD, regeneration). These comparisons are not derived from the scheme's definitions and provide independent evidence. The acknowledged limitation in Section 5.2 that "an adaptive search for a semantically distinct image whose code still lands in the candidate set remains uncharacterized" is a genuine security gap, but it is a threat-model weakness, not circular reasoning. There is no load-bearing self-citation, no imported uniqueness theorem, and no fitted parameter renamed as a prediction. The only mildly self-referential aspect is the use of CLIP embeddings both for defining semantics and for detection, which is a design choice rather than a circular step.

Assumptions & free parameters 7 free parameters · 5 assumptions · 0 invented entities

The central design depends on several hand-chosen constants and three domain assumptions. The main free parameters are the ring band, injection timing/strength, canonicalization settings, and candidate-set sizes, all selected empirically on the evaluation datasets. The method assumes a deterministic invertible sampler, a frozen CLIP encoder stable under canonicalization, and uncharacterized hardness of finding code collisions inside the candidate cone. No new physical entities are introduced.

free parameters (7)

Ring band R = radii 16 to 20 on latent channel 0
Chosen from content-energy and phase-survival curves on 500 images (Fig. 2a); trades fidelity vs detectability.
Injection start t0 = 40 of 50 DDIM steps
Selected from ablation pooled over the three prompt datasets (Fig. 6a); deepest start that keeps code survival and robustness.
Peak blend strength alpha0 = 0.3
Set so the code stays intact while the ring remains detectable; no independent validation split reported.
Canonicalization settings = luminance norm, Gaussian blur sigma=2, JPEG quality 25, K=8 augmentations
Chosen to stabilize CLIP code under distortions; ablation shows raw reading falls to 0.51 code survival at JPEG 20.
Candidate-set parameters = Hamming radius ts=3, low-margin bits L=7
Selected from grid on cached images (Fig. 7); governs the acceptance cone and the security bound.
Content code length = 24-bit SimHash
Code length trades collision hardness vs drift tolerance; chosen without reported optimization.
Detection threshold tau = 0.209 (1% FPR)
Calibrated on 1500 non-watermarked images; standard practice but still a tuned constant.

assumptions (5)

domain assumption DDIM sampling is deterministic and invertible, so the trajectory can be retraced from a query image.
Invoked in Section 3 and required in the conclusion: 'The construction needs a deterministic invertible sampler and a frozen perceptual encoder.'
domain assumption CLIP ViT-B/32 embedding, after canonicalization, is stable under common distortions and sensitive to semantic changes.
The entire code-reading pipeline (Section 4.1) relies on this; the paper measures but does not derive it.
domain assumption Phase-only Fourier rings survive JPEG, blur, and brightness because these distortions are approximately zero-phase multiplicative on magnitudes.
Assumed in Section 4.1 ring design; validated empirically in Figure 5.
standard math Keyed SimHash and HMAC are unpredictable without k, so released images do not reveal the mapping from code to ring.
Standard cryptographic assumption; used in Section 4.1 to prevent distillation of a common pattern.
ad hoc to paper No efficient adversary can find a semantically distinct image whose code lies in the candidate set C(hat(c)).
Stated as open in Section 5.2: 'an adaptive search ... remains uncharacterized.' This is the paper's own security parameter.

how reviews work

0 comments

Cite this review

Pith. "Pith review of IRIS: Visual-Semantic Binding for Forgery-Resistant Watermarking of Diffusion Images." pith.science (2026). https://pith.science/paper/G2WGDL37

@misc{pith2026260803539,
  author       = {Pith},
  title        = {Pith review of: IRIS: Visual-Semantic Binding for Forgery-Resistant Watermarking of Diffusion Images},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/G2WGDL37}},
  note         = {Machine review of arXiv:2608.03539}
}

read the original abstract

Most in-generation diffusion watermarks embed patterns independent of the image that carries them, and attackers transplant the marks onto images the generator did not produce, resulting in forgery. Binding the mark to visual semantics prevents such transplantation, yet existing bindings anchor to a proxy image rather than the image they mark. Realizing visual-semantic binding inside generation faces two challenges. The mark derives from the image itself yet enters the sampling trajectory before that image exists, and may itself shift the semantics it binds. The binding also meets opposite sensitivity demands, breaking under semantic change while holding through common processing. We present IRIS, a training-free watermarking scheme that embeds an Intrinsic Ring Identifier from Semantics. IRIS reads a content code from the non-watermarked generated image, derives a one-time ring from the code and a secret key, returns to the final low-noise steps of the same trajectory and blends the ring in, after the semantics it binds are settled. To meet the opposite sensitivity demands, the code is read through a canonicalization shared between embedding and detection, holding through common distortions and mild regeneration while flipping under semantic change. Detection recomputes the ring from the query image and the key alone, and the mark therefore fails on a foreign or spliced image, with acceptance tracking semantic displacement. On three prompt datasets IRIS detects reliably and stays close to its same-seed non-watermarked counterpart, a fidelity prior in-generation marks do not reach. While forgeries transfer fixed-pattern marks and regeneration strips post-hoc marks, IRIS alone among the compared marks withstands both.

Figures

Figures reproduced from arXiv: 2608.03539 by the authors.

**Figure 1.** The IRIS framework. (a) Generation turns the canonicalized CLIP embedding of the preview into a keyed one-time ring and blends it into the late DDIM steps of the same trajectory. (b) An attack replaces part of the content. (c) Detection correlates the ring derived from the query’s semantics against the observed band. The replacement moves the recomputed code, the keyed hash maps it to a different ring, and the score… view at source ↗

**Figure 2.** (a) Log-scaled content energy per coefficient and phase survival under Gaussian noise at σ=0.1 across radial frequency. (b) Write-band phase coherence ρr over DDIM steps, with the threshold dashed and injection start dotted. To keep the mapping from an image to its ring unlearnable from released watermarked images, we map the code to the ring’s seed through a keyed hash g(k, c) = HMACk(c). Flipping a single bit of t… view at source ↗

**Figure 3.** Fidelity under one DiffusionDB prompt. IRIS stays pixel-close to its same-seed counterpart, per-channel difference [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

Figures from the paper (7 more)

**Figure 4.** Figure 4: Binding mechanism. (a) TPR@1%FPR versus the replaced fraction. (b) TPR@1%FPR of the same detectors versus the CLIP-image displacement of the edits. noise, verified bit-identical before injection, and still moves the lighthouse at PSNR 18.9. IRIS holds both forgery atta…

**Figure 6.** Figure 6: (a) Injection-start ablation. (b) Canonicalization ablation, raw versus canonicalized readout. re-aligns the image, and the remaining gap comes from interpolation and the corners lost to rotation. Geometric misalignment is a long-standing synchronization problem for …

**Figure 8.** Figure 8: Fidelity across prompts from the three evaluation sources. Each row shows the non-watermarked counterpart, the IRIS [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]

**Figure 9.** Figure 9: IRIS under distortion, forgery, and removal across prompts. Each row shows the watermarked image, additive noise, [PITH_FULL_IMAGE:figures/full_fig_p011_9.png]

**Figure 10.** Figure 10: Tree-Ring under the same operations, scored by its own detector, green above its threshold and red below it. [PITH_FULL_IMAGE:figures/full_fig_p012_10.png]

**Figure 11.** Figure 11: Gaussian Shading under the same operations, scored by its own detector, green above its threshold and red below it. [PITH_FULL_IMAGE:figures/full_fig_p013_11.png]

**Figure 12.** Figure 12: SEAL under the same operations, scored by its own detector, green above its threshold and red below it. [PITH_FULL_IMAGE:figures/full_fig_p014_12.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

37 extracted references · 25 canonical work pages

[1]

T.; Hegde, C.; and Cohen, N

Arabi, K.; Witter, R. T.; Hegde, C.; and Cohen, N. 2025. Seal: Semantic aware image watermarking. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 16196--16205

work page 2025
[2]

Betker, J.; Goh, G.; Jing, L.; Brooks, T.; Wang, J.; Li, L.; Ouyang, L.; Zhuang, J.; Lee, J.; Guo, Y.; et al. 2023. Improving Image Generation with Better Captions. Technical report, OpenAI. https://cdn.openai.com/papers/dall-e-3.pdf

work page 2023
[3]

Charikar, M. S. 2002. Similarity estimation techniques from rounding algorithms. In Proceedings of the thiry-fourth annual ACM symposium on Theory of computing, 380--388

2002
[4]

Ci, H.; Yang, P.; Song, Y.; and Shou, M. Z. 2024. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification. In European conference on computer vision, 338--354. Springer

work page 2024
[5]

Coalition for Content Provenance and Authenticity . 2026. Content Credentials: C2PA Technical Specification, Version 2.4. https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html

work page 2026
[6]

Cox, I.; Miller, M.; Bloom, J.; Fridrich, J.; and Kalker, T. 2007. Digital Watermarking and Steganography. Morgan Kaufmann, 2 edition

work page 2007
[7]

J.; Kilian, J.; Leighton, F

Cox, I. J.; Kilian, J.; Leighton, F. T.; and Shamoon, T. 1997. Secure spread spectrum watermarking for multimedia. IEEE transactions on image processing, 6(12): 1673--1687

work page 1997
[8]

European Parliament and Council of the European Union . 2024. Regulation ( EU ) 2024/1689 Laying Down Harmonised Rules on Artificial Intelligence. https://eur-lex.europa.eu/eli/reg/2024/1689/oj

work page 2024

Show all 37 references

[9]

Fernandez, P.; Couairon, G.; J \'e gou, H.; Douze, M.; and Furon, T. 2023. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 22466--22477

2023
[10]

Gao, Z.; Yang, Y.; Li, X.; Feng, X.; Fan, H.; Song, Y.; and Jiang, J. 2026. SLICE: Semantic Latent Injection via Compartmentalized Embedding for Image Watermarking. arXiv preprint arXiv:2603.12749

2026
[11]

Gunn, S.; Zhao, X.; and Song, D. 2025. An Undetectable Watermark for Generative Image Models. In The Thirteenth International Conference on Learning Representations

2025
[12]

Gustavosta. 2022. Stable Diffusion Prompts. https://huggingface.co/datasets/Gustavosta/Stable-Diffusion-Prompts. Accessed: 2026-07-28

2022
[13]

Heusel, M.; Ramsauer, H.; Unterthiner, T.; Nessler, B.; and Hochreiter, S. 2017. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems, 30

2017
[14]

Huang, H.; Wu, Y.; and Wang, Q. 2024. Robin: Robust and invisible watermarks for diffusion models with adversarial optimization. Advances in Neural Information Processing Systems, 37: 3937--3963

2024
[15]

Jain, A.; Kobayashi, Y.; Murata, N.; Takida, Y.; Shibuya, T.; Mitsufuji, Y.; Cohen, N.; Memon, N.; and Togelius, J. 2025. Forging and Removing Latent-Noise Diffusion Watermarks Using a Single Image. arXiv:2504.20111

2025 arXiv
[16]

Labs, B. F.; Batifol, S.; Blattmann, A.; Boesel, F.; Consul, S.; Diagne, C.; Dockhorn, T.; English, J.; English, Z.; Esser, P.; Kulal, S.; Lacey, K.; Levi, Y.; Li, C.; Lorenz, D.; Müller, J.; Podell, D.; Rombach, R.; Saini, H.; Sauer, A.; and Smith, L. 2025. FLUX.1 Kontext: Fl...

2025 arXiv
[17]

Licks, V.; and Jordan, R. 2005. Geometric attacks on image watermarking systems. IEEE multimedia, 12(3): 68--78

2005
[18]

Lin, T.-Y.; Maire, M.; Belongie, S.; Hays, J.; Perona, P.; Ramanan, D.; Doll \'a r, P.; and Zitnick, C. L. 2014. Microsoft coco: Common objects in context. In European conference on computer vision, 740--755. Springer

2014
[19]

Lu, Z.; Huang, D.; Bai, L.; Qu, J.; Wu, C.; Liu, X.; and Ouyang, W. 2023. Seeing is not always believing: Benchmarking human and model perception of ai-generated images. Advances in neural information processing systems, 36: 25435--25447

2023
[20]

Madry, A.; Makelov, A.; Schmidt, L.; Tsipras, D.; and Vladu, A. 2018. Towards deep learning models resistant to adversarial attacks. In International conference on learning representations

2018
[21]

M \"u ller, A.; Lukovnikov, D.; Thietke, J.; Fischer, A.; and Quiring, E. 2025. Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models. In 2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 20937--20946. IEEE Computer Society

2025
[22]

A.; Ajay, M

Navas, K. A.; Ajay, M. C.; Lekshmi, M.; Archana, T. S.; and Sasikumar, M. 2008. DWT-DCT-SVD based watermarking. In 2008 3rd International Conference on Communication Systems Software and Middleware and Workshops (COMSWARE '08), 271--274

2008
[23]

A.; Anderson, R

Petitcolas, F. A.; Anderson, R. J.; and Kuhn, M. G. 1998. Attacks on copyright marking systems. In International workshop on information hiding, 218--238. Sprx'ringer

1998
[24]

Qu, Y.; Shen, X.; He, X.; Backes, M.; Zannettou, S.; and Zhang, Y. 2023. Unsafe diffusion: On the generation of unsafe images and hateful memes from text-to-image models. In Proceedings of the 2023 ACM SIGSAC conference on computer and communications security, 3403--3417

2023
[25]

W.; Hallacy, C.; Ramesh, A.; Goh, G.; Agarwal, S.; Sastry, G.; Askell, A.; Mishkin, P.; Clark, J.; et al

Radford, A.; Kim, J. W.; Hallacy, C.; Ramesh, A.; Goh, G.; Agarwal, S.; Sastry, G.; Askell, A.; Mishkin, P.; Clark, J.; et al. 2021. Learning transferable visual models from natural language supervision. In International conference on machine learning, 8748--8763. PmLR

2021
[26]

Rombach, R.; Blattmann, A.; Lorenz, D.; Esser, P.; and Ommer, B. 2022. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 10684--10695

2022
[27]

J.; and Boland, F

Ruanaidh, J.; Dowling, W. J.; and Boland, F. M. 1996. Phase watermarking of digital images. In Proceedings of 3rd IEEE international conference on image processing, volume 3, 239--242. IEEE

1996
[28]

S.; Rezaei, K.; Kumar, A.; Chegini, A.; Wang, W.; and Feizi, S

Saberi, M.; Sadasivan, V. S.; Rezaei, K.; Kumar, A.; Chegini, A.; Wang, W.; and Feizi, S. 2024. Robustness of AI -Image Detectors: Fundamental Limits and Practical Attacks. In The Twelfth International Conference on Learning Representations

2024
[29]

J.; Montoya, E.; Munechika, D.; Yang, H.; Hoover, B.; and Chau, D

Wang, Z. J.; Montoya, E.; Munechika, D.; Yang, H.; Hoover, B.; and Chau, D. H. 2023. Diffusiondb: A large-scale prompt gallery dataset for text-to-image generative models. In Proceedings of the 61st annual meeting of the association for computational linguistics (volume 1: Lon...

2023
[30]

Wen, Y.; Kirchenbauer, J.; Geiping, J.; and Goldstein, T. 2023. Tree-rings watermarks: Invisible fingerprints for diffusion images. Advances in Neural Information Processing Systems, 36: 58047--58063

2023
[31]

Xie, J.; Ou, C.; Yu, P.; Zhou, X.; Huang, D.; Fei, J.; Shen, Z.; and Xia, Z. 2026 a . Dual-Guard: Dual-Channel Latent Watermarking for Provenance and Tamper Localization in Diffusion Images. arXiv preprint arXiv:2604.19090

2026 arXiv
[32]

Xie, J.; Yu, P.; Fei, J.; Zhou, X.; and Xia, Z. 2026 b . SafeTR: Verifiable Semantic Tree-Ring Watermark for Diffusion Model Against Forgery Attacks. In ICASSP 2026-2026 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 9505--9511. IEEE

2026
[33]

Yang, P.; Ci, H.; Song, Y.; and Shou, M. Z. 2024 a . Can simple averaging defeat modern watermarks? Advances in Neural Information Processing Systems, 37: 56644--56673

2024
[34]

Yang, Z.; Zeng, K.; Chen, K.; Fang, H.; Zhang, W.; and Yu, N. 2024 b . Gaussian shading: Provable performance-lossless image watermarking for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 12162--12171

2024
[35]

Zhang, X.; Yang, Z.; Chen, K.; Ma, L.; Zhang, W.; and Yu, N. 2026. SemBind: Binding Diffusion Watermarks to Semantics Against Black-Box Forgery Attacks. In Forty-third International Conference on Machine Learning

2026
[36]

Zhao, X.; Zhang, K.; Su, Z.; Vasan, S.; Grishchenko, I.; Kruegel, C.; Vigna, G.; Wang, Y.-X.; and Li, L. 2024. Invisible image watermarks are provably removable using generative ai. Advances in neural information processing systems, 37: 8643--8672

2024
[37]

R.; Fei, Y.; Xu, X.; and Ren, S

Zhou, T.; Ding, R.; Liu, G.; Fleming, C.; Kompella, R. R.; Fei, Y.; Xu, X.; and Ren, S. 2026. MetaSeal: Defending against image attribution forgery through content-dependent cryptographic watermarks. Transactions on Machine Learning Research

2026

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.

[1] [1]

T.; Hegde, C.; and Cohen, N

Arabi, K.; Witter, R. T.; Hegde, C.; and Cohen, N. 2025. Seal: Semantic aware image watermarking. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 16196--16205

work page 2025

[2] [2]

Betker, J.; Goh, G.; Jing, L.; Brooks, T.; Wang, J.; Li, L.; Ouyang, L.; Zhuang, J.; Lee, J.; Guo, Y.; et al. 2023. Improving Image Generation with Better Captions. Technical report, OpenAI. https://cdn.openai.com/papers/dall-e-3.pdf

work page 2023

[3] [3]

Charikar, M. S. 2002. Similarity estimation techniques from rounding algorithms. In Proceedings of the thiry-fourth annual ACM symposium on Theory of computing, 380--388

2002

[4] [4]

Ci, H.; Yang, P.; Song, Y.; and Shou, M. Z. 2024. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification. In European conference on computer vision, 338--354. Springer

work page 2024

[5] [5]

Coalition for Content Provenance and Authenticity . 2026. Content Credentials: C2PA Technical Specification, Version 2.4. https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html

work page 2026

[6] [6]

Cox, I.; Miller, M.; Bloom, J.; Fridrich, J.; and Kalker, T. 2007. Digital Watermarking and Steganography. Morgan Kaufmann, 2 edition

work page 2007

[7] [7]

J.; Kilian, J.; Leighton, F

Cox, I. J.; Kilian, J.; Leighton, F. T.; and Shamoon, T. 1997. Secure spread spectrum watermarking for multimedia. IEEE transactions on image processing, 6(12): 1673--1687

work page 1997

[8] [8]

European Parliament and Council of the European Union . 2024. Regulation ( EU ) 2024/1689 Laying Down Harmonised Rules on Artificial Intelligence. https://eur-lex.europa.eu/eli/reg/2024/1689/oj

work page 2024