SuperMark: Robust and Training-free Image Watermarking via Diffusion-based Super-Resolution

Han Qiu; Jie Zhang; Jiwei Li; Qing Guo; Runyi Hu; Tianwei Zhang; Yiming Li

REVIEW 3 major objections 6 minor 1 cited by

SuperMark: Robust and Training-free Image Watermarking via Diffusion-based Super-Resolution

T0 review · 3 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read SuperMark claims that a pretrained super-resolution diffusion model, with no fine-tuning, can embed watermarks in its initial noise and recover them from distorted images by DDIM inversion, reaching 99.46% bit accuracy under normal…

desk verdict SuperMark is a clever training-free watermarking scheme built on diffusion SR and DDIM inversion; the empirical case is strong, but the inversion-under-mismatched-conditioning assumption is not properly examined and the fidelity framing is misleading. read the letter →

arxiv 2412.10049 v1 pith:LLDT7JXY submitted 2024-12-13 cs.CV

Runyi Hu , Jie Zhang , Yiming Li , Jiwei Li , Qing Guo , Han Qiu , Tianwei Zhang This is my paper · ORCID

classification cs.CV

keywords imagewatermarkingdiffusionmodelssuper-resolutionDDIMinversiontraining-freeGaussianShadingTree-Ringwatermarkrobustness

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

SuperMark sets out to break the robustness–fidelity trade-off that plagues trained encoder–decoder watermarking systems by removing training altogether. The paper's central claim is that a pretrained diffusion-based super-resolution model can act as both embedder and extractor: the watermark is written into the initial Gaussian noise, the model denoises that noise into a watermarked image, and DDIM inversion of a distorted copy recovers enough of the original noise to read the message. On 500 MS-COCO images the pipeline reports 99.46% average bit accuracy under JPEG, cropping, blur, noise, and brightness changes, and 89.29% under VAE-based and diffusion-based adaptive attacks, with PSNR 32.49 and SSIM 0.93. If true, the result matters because watermarking could ride on off-the-shelf generative models rather than bespoke trained decoders, and would inherit improvements in super-resolution automatically.

What carries the argument

The central object is DDIM inversion of a latent diffusion super-resolution model. DDIM gives a deterministic map from Gaussian noise to image, and its inverse reconstructs the starting noise from an image; SuperMark exploits the observation, borrowed from text-to-image watermarking, that this inverse is stable under perturbation. The watermarking front-end is Gaussian Shading—bit strings converted into a Gaussian-preserving sampling of the noise, so fidelity is untouched—or Tree-Ring for ring patterns in Fourier space. The SR model's conditioning on a low-resolution image is what keeps the denoised output close to the cover image: the original is downscaled, denoised to a larger version, downscaled again, and only a fraction $f_s$ of that residual is added back, balancing fidelity and robustness. No network is trained or fine-tuned.

What would settle it

Take the default COCO test set and apply a distortion outside the reported suite—for example, JPEG at quality 10, a 45° rotation with no cropping, or a 50% center crop—then measure bit accuracy. If any such common distortion drives accuracy to near chance (50%) while a trained scheme such as StegaStamp retains high accuracy, the claim that DDIM inversion is inherently robust would be refuted.

Watch

Extended reading notes

Core claim

The paper claims that watermark embedding/extraction and diffusion denoising/noising are two sides of the same reversible transformation. Concretely, it embeds a 32-bit message into the initial Gaussian noise of SD-Upscaler, a pretrained latent diffusion super-resolution model, using Gaussian Shading's bit-to-noise sampling; the model's determinism lets DDIM inversion map a distorted watermarked image back to the watermarked noise, from which the message is read by voting over replicated copies. The authors report an average 99.46% bit accuracy across five normal distortions, 89.29% across four adaptive attacks (VAE compression and diffusion editing), and fidelity comparable to trained baselines, with transfer across datasets, SR models, injection schemes, and resolutions. The load-bearing assertion is that the DDIM inversion of the distorted image, conditioned on its own downscaled version rather than the original low-resolution input, still recovers the watermarked noise.

Load-bearing premise

Extraction assumes DDIM inversion of a distorted image still returns the watermarked starting noise, even though the inversion is conditioned on the distorted image's own downscaled copy rather than on the exact low-resolution image used when embedding.

Editorial extensions

If this is right

Because the SR model is frozen and interchangeable, any improved diffusion-based super-resolution model should directly improve SuperMark's fidelity and robustness—the paper demonstrates this by swapping SD-Upscaler for LDM-SR.
The watermarking scheme is not tied to one injection method: switching from Gaussian Shading to Tree-Ring gives SuperMark near-perfect robustness to 90° rotation, which the default scheme lacks.
Higher-resolution cover images support longer messages (up to 72 bits at 768×768 in the paper's tests) with essentially unchanged robustness, because higher-resolution super-resolution leaves more recoverable pixels.
Because extraction is inversion rather than classification, the method carries no trained decoder to attack; adaptive attacks that fool trained decoders reduce accuracy only from about 99% to about 89%.
The framework can be applied after generation to both real and synthetic images, which is broader than in-generation watermarking.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A natural stress test the paper does not run: distortions that break the conditioning assumption, such as severe cropping that removes most of the image or resizing to a different aspect ratio, could drop accuracy sharply; measuring that boundary would map the method's true envelope.
The same 'watermark in noise, recover by inversion' recipe may transfer to other image-conditioned diffusion tasks—restoration, inpainting, or editing—turning any deterministic conditional diffusion model into a general post-hoc watermarking channel for real images.
If DDIM inversion is the bottleneck, the paper's own extension logic suggests that exact-inversion solvers or single-step distilled SR models could make extraction faster and more accurate; the reported numbers are a floor, not a ceiling.
Because the watermark is embedded as a fraction of the SR residual, the method implicitly concentrates the message at semantic edges; an editor's smoothing filter targeted at edges is a plausible adaptive attack not tested here.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

SuperMark is a genuinely clever composition: embed the watermark in the initial noise of a pretrained diffusion SR model, then extract it by DDIM inversion. The trick is real—they show it works across datasets, SR models, injection methods, and resolutions, with bit accuracies in the high 90s under normal distortions and high 80s under strong learned compression and diffusion editing attacks. That is the main thing to know.

What is actually new: the paper treats a super-resolution diffusion model as a watermarking engine without any training. The residual blending (Iori + fs*(Isr - Iori)) is a neat way to manage fidelity, and the framework is modular: swap Gaussian Shading for Tree-Ring, swap SD-Upscaler for LDM-SR, and it still works. The paper also honestly discusses inference overhead and points to acceleration methods.

Where it gets soft. First, the fidelity claim in the abstract ('comparable to existing methods') is misleading relative to Table 1. SuperMark's PSNR is 32.5; most baselines sit in the high 30s to 43. It beats only StegaStamp and RoSteALS. That needs rewording. Second—and this is the load-bearing issue—the extraction pipeline relies on DDIM inversion tolerating a conditioning mismatch. At embedding, the model sees Ilow; at extraction, it sees a downscaled, distorted version of the blended watermarked image. The paper cites the robustness of DDIM inversion from text-to-image works, but those keep the prompt fixed. Here the conditioning input is derived from the attacked image and is never equal to the embedding-time input. The paper never ablates this. The empirical results are encouraging, but no attack targets the conditioning path directly (e.g., heavy low-pass filtering before downscaling). I'd want a dedicated experiment on that before trusting the 89% adaptive-attack number as a guarantee.

Third, the headline numbers come from hyperparameters (fs, Slow) selected on the same COCO test set, with no error bars or significance tests. Fourth, no code is released, which hurts reproducibility for a method that is otherwise embarrassingly simple.

None of this kills the paper. The central idea is sound enough to deserve a serious referee. The citation pattern is fine; the self-reference to Robust-Wide is not load-bearing. A revision should fix the fidelity wording, add an ablation on the conditioning mismatch (or a theoretical argument), report variance, and release code.

Referee Report

3 major / 6 minor

Summary. The paper proposes SuperMark, a training-free watermarking framework that composes existing Gaussian-noise watermarking methods (Gaussian Shading, Tree-Ring) with a pre-trained diffusion-based super-resolution model. Watermark embedding injects the watermark into the initial Gaussian noise used by the SR model to upsample a downscaled cover image, and the watermarked image is formed as a blend of the original and the super-resolved output (Eq. 3). Extraction performs DDIM inversion on the (possibly distorted) watermarked image, using a downscaled and upscaled version of the attacked image as conditioning, to recover the initial noise and decode the watermark. The paper reports extensive experiments on 500 COCO images and four other datasets, claiming 99.46% extraction accuracy under normal distortions and 89.29% under adaptive attacks, with PSNR 32.50 and SSIM 0.93, plus transferability across SR models, injection methods, datasets, and resolutions.

Significance. If the empirical claims hold, SuperMark is a significant contribution to post-processing watermarking: it requires no training, composes existing watermark-injection techniques, and shows robustness against standard distortions and generative attacks. The framework is flexible, and the ablations over strength factor, low-resolution size, steps, and bit length are useful. However, the paper's central mechanism—robustness of DDIM inversion under a conditioning mismatch—is not theoretically or experimentally isolated, and the fidelity claim in the abstract is overstated relative to Table 1. The evaluation also lacks error bars or significance tests, which matters for the comparisons where the margins are small.

major comments (3)

[Sec. 3.3–3.4, Eq. (3)] The extraction pipeline inverts the SR model from Z'_0_wm = E(I'^up_wm) conditioned on I'_low, a downscaled, distorted version of the watermarked image, rather than the original Ilow used at embedding; moreover, Eq. (3) means Iwm is only a 40% blend of the SR residual, so inversion does not start from the clean SR output. The paper's citations to text-to-image watermarking works (Wen et al., Yang et al.) demonstrate DDIM-inversion robustness only when the conditioning (text prompt) is fixed and known, which is not the case here. The paper should provide an analysis or a dedicated experiment (e.g., attacking only the conditioning path, or varying the conditioning mismatch) to validate that inversion remains accurate under this mismatch; without it, the central robustness claim is not substantiated in the exact regime where the method is weakest.
[Abstract and Table 1] The claim that SuperMark achieves fidelity "comparable to existing methods" is not supported by Table 1. SuperMark's PSNR (32.50) and SSIM (0.93) are lower than most baselines (MBRS 43.25/0.987, CIN 41.74/0.979, RivaGAN 40.53/0.979, PIMoG 37.46/0.977, SepMark 35.91/0.952, DwtDctSvd 38.11/0.973); only StegaStamp (28.69) and RoSteALS (28.34) have lower PSNR. The phrasing "comparable" should be qualified to "comparable to the most robust baselines (StegaStamp and RoSteALS)" or the fidelity comparison should be presented with appropriate context, since the robustness-fidelity trade-off is a load-bearing part of the paper's central claim.
[Sec. 4.1 and Table 1] All reported numbers are mean bit accuracies over 500 randomly selected images, but the paper provides no standard deviations, confidence intervals, or significance tests. This is particularly important for the adaptive-attack comparison with StegaStamp (overall 89.29% vs 96.07%, and per-attack differences are small for Zhao23: 0.87 vs 0.93) and for the claim that SuperMark "significantly surpasses" most methods in robustness. Reporting variance or bootstrap confidence intervals would allow readers to judge whether the differences are meaningful.

minor comments (6)

[Sec. 3.3] The interpolation method used for downscaling and upscaling is not specified; please state it (e.g., bicubic) for reproducibility.
[Sec. 1 and Sec. 4.4] There are typos: "inherent roboust extraction" in Sec. 1 and "robustneelatively" in Sec. 4.4.
[Table 3 caption] The caption should state that both SR models are evaluated with 16-bit watermarks (as described in the text) to avoid confusion with the default 32-bit setting in Table 1.
[Sec. 4.4, Figure 4] The finding that inversion steps have minimal effect on robustness is surprising given the central role of DDIM inversion; a brief explanation or an additional ablation over a wider range of steps would strengthen the reader's understanding.
[Appendix A.3, Figure 7] There is a typo in the caption: "StgeaStamp" should be "StegaStamp".
[Figure 2] Figure 2 is difficult to read; enlarging the labels and clarifying the flow between embedding and extraction would improve accessibility.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: SuperMark composes externally published components (Gaussian Shading, Tree-Ring, DDIM inversion, SD-Upscaler) and is evaluated against external benchmarks; the only self-citation is non-load-bearing.

full rationale

SuperMark's derivation chain does not reduce any prediction to its own inputs. The watermark is injected by off-the-shelf Gaussian Shading/Tree-Ring procedures (Sec. 3.3, Appendix A.1), the SR model is a frozen pretrained SD-Upscaler, and extraction uses standard DDIM inversion (Sec. 3.4). The reported accuracies (99.46% normal, 89.29% adaptive) are measured outcomes on a 500-image COCO subset and four additional datasets, not quantities forced by construction. Hyperparameters (fs, Slow, fc, fhw, steps) are tuned in ablations (Sec. 4.4) and held fixed for the headline results; this is parameter selection, not a fitted input renamed as a prediction. The only self-citation is Robust-Wide (Hu et al., 2024), mentioned in Secs. 1 and 2.3 as one of several existing robust watermarking baselines; it plays no role in SuperMark's mechanism or evaluation, so it is not load-bearing. The skeptical concern about DDIM inversion under mismatched low-resolution conditioning (I'_low vs Ilow and E(I'^up_wm) vs Z0_wm) is a genuine robustness/correctness risk, but it is not circularity: the claim is empirical, and the paper does not define extraction accuracy in terms of that assumption. No equation in the paper is equivalent to its inputs by construction, and no conclusion rests on an unverified self-citation. Hence the appropriate finding is no significant circularity, with a score of 1 reflecting only the presence of a non-load-bearing self-citation.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The method's central performance relies on several external, unproven properties: stable DDIM inversion of SR models under mismatched conditioning, the fidelity-preserving property of Gaussian Shading's noise construction, and the representativeness of the tested attacks. These are pulled from prior literature or asserted without derivation, so they are listed as axioms.

free parameters (4)

strength factor fs = 0.4
Scales the residual added to the original image (Eq. 3). Chosen on COCO after ablation in Section 4.4; directly trades fidelity against robustness.
low image size Slow = 128
Downscaling size of the original image before SR; larger values improve fidelity but hurt robustness (Section 4.4).
Gaussian Shading replication factors fc, fhw = fc=2, fhw=32
Define how many copies of each watermark bit are embedded; determine bit length and redundancy (Appendix A.1).
inference and inversion steps = 25
Number of DDIM steps for both sampling and inversion; more steps improve robustness but slightly reduce fidelity (Figure 4).

assumptions (5)

domain assumption The pretrained SD-Upscaler (and LDM-SR) is a valid image-conditioned diffusion SR model that supports both forward denoising and DDIM inversion.
The entire method reduces to using M for denoising (Eq. 1) and inversion (Section 3.4); no proof is given that M supports stable inversion for arbitrary conditioning.
domain assumption DDIM inversion accurately recovers the initial latent noise even when the conditioning image differs from the one used at generation.
Section 3.4 applies DDIM inversion with conditioning on I'_low, which after distortion differs from I_low used at embedding; the paper relies on this approximate invertibility, which is asserted rather than derived.
domain assumption Gaussian Shading's construction preserves the Gaussian distribution of the initial noise so that watermark embedding does not degrade the SR output.
Appendix A.1 cites Yang et al. 2024 for this property; SuperMark relies on it to embed messages without hurting fidelity.
domain assumption The VAE encoder and decoder of the SR model preserve enough information that upscaled distorted watermarked images still contain extractable watermark information.
Extraction includes upscaling and VAE encoding (Section 3.4); the paper provides no analysis of VAE-induced information loss.
domain assumption The chosen distortion and attack configurations are representative of real-world watermark removal attempts.
Evaluation depends on these simulated attacks; the paper does not test against all possible adaptive attacks.

how reviews work

0 comments

Cite this review

Pith. "Pith review of SuperMark: Robust and Training-free Image Watermarking via Diffusion-based Super-Resolution." pith.science (2026). https://pith.science/paper/LLDT7JXY

@misc{pith2026241210049,
  author       = {Pith},
  title        = {Pith review of: SuperMark: Robust and Training-free Image Watermarking via Diffusion-based Super-Resolution},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LLDT7JXY}},
  note         = {Machine review of arXiv:2412.10049}
}

read the original abstract

In today's digital landscape, the blending of AI-generated and authentic content has underscored the need for copyright protection and content authentication. Watermarking has become a vital tool to address these challenges, safeguarding both generated and real content. Effective watermarking methods must withstand various distortions and attacks. Current deep watermarking techniques often use an encoder-noise layer-decoder architecture and include distortions to enhance robustness. However, they struggle to balance robustness and fidelity and remain vulnerable to adaptive attacks, despite extensive training. To overcome these limitations, we propose SuperMark, a robust, training-free watermarking framework. Inspired by the parallels between watermark embedding/extraction in watermarking and the denoising/noising processes in diffusion models, SuperMark embeds the watermark into initial Gaussian noise using existing techniques. It then applies pre-trained Super-Resolution (SR) models to denoise the watermarked noise, producing the final watermarked image. For extraction, the process is reversed: the watermarked image is inverted back to the initial watermarked noise via DDIM Inversion, from which the embedded watermark is extracted. This flexible framework supports various noise injection methods and diffusion-based SR models, enabling enhanced customization. The robustness of the DDIM Inversion process against perturbations allows SuperMark to achieve strong resilience to distortions while maintaining high fidelity. Experiments demonstrate that SuperMark achieves fidelity comparable to existing methods while significantly improving robustness. Under standard distortions, it achieves an average watermark extraction accuracy of 99.46%, and 89.29% under adaptive attacks. Moreover, SuperMark shows strong transferability across datasets, SR models, embedding methods, and resolutions.

Figures

Figures reproduced from arXiv: 2412.10049 by the authors.

**Figure 2.** The end-to-end inference pipeline of SuperMark. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗

**Figure 3.** The impact of varying the low image size [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗

Figures from the paper (13 more)

**Figure 4.** Figure 4: Effects of SuperMark on fidelity and robustness with varying inference and inversion [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]

**Figure 5.** Figure 5: Fidelity and robustness when embedding watermark bits of different lengths. [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]

**Figure 6.** Figure 6: Some visual results from the default COCO dataset. The last row marks the distortion or [PITH_FULL_IMAGE:figures/full_fig_p015_6.png]

**Figure 7.** Figure 7: Fidelity distribution of watermarked images generated by StgeaStamp, RoSteALS and [PITH_FULL_IMAGE:figures/full_fig_p015_7.png]

**Figure 8.** Figure 8: Some watermarked images with relatively low fidelity generated by SuperMark. From the [PITH_FULL_IMAGE:figures/full_fig_p016_8.png]

**Figure 9.** Figure 9: Comparison of watermarked images generated by StegaStamp, RoSteALS and Super [PITH_FULL_IMAGE:figures/full_fig_p017_9.png]

**Figure 10.** Figure 10: Comparison of watermarked images generated by StegaStamp, RoSteALS and Super [PITH_FULL_IMAGE:figures/full_fig_p018_10.png]

**Figure 11.** Figure 11: Some watermarked images generated by SuperMark with the original images sampled [PITH_FULL_IMAGE:figures/full_fig_p019_11.png]

**Figure 12.** Figure 12: Some watermarked images generated by SuperMark with the original images sampled [PITH_FULL_IMAGE:figures/full_fig_p019_12.png]

**Figure 13.** Figure 13: Some watermarked images generated by SuperMark with the original images sampled [PITH_FULL_IMAGE:figures/full_fig_p020_13.png]

**Figure 14.** Figure 14: Some watermarked images generated by SuperMark with the original images sampled [PITH_FULL_IMAGE:figures/full_fig_p020_14.png]

**Figure 15.** Figure 15: Comparison of watermarked images generated by SuperMark with default setting, LDM [PITH_FULL_IMAGE:figures/full_fig_p021_15.png]

**Figure 16.** Figure 16: Comparison of watermarked images generated by SuperMark with default setting, LDM [PITH_FULL_IMAGE:figures/full_fig_p021_16.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

VideoShield: Regulating Diffusion-based Video Generation Models via Watermarking
cs.CV 2025-01 conditional novelty 6.0 of 10

A training-free framework that watermarks diffusion-generated videos during generation and localizes both temporal and spatial tampering.

Reference graph

Works this paper leans on

13 extracted references · 4 canonical work pages · cited by 1 Pith paper

[4]

Diffusetrace: A transparent and flexible water- marking scheme for latent diffusion model

11 Preprint Liangqi Lei, Keke Gai, Jing Yu, and Liehuang Zhu. Diffusetrace: A transparent and flexible water- marking scheme for latent diffusion model. arXiv preprint arXiv:2405.02696,

arXiv
[5]

Microsoft coco: Common objects in context

Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll´ar, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer Vision–ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pp. 740–755. Springer,

2014
[7]

Ac- cessed: 2024-09-19

URL https://www.pbs.org/newshour/politics/new-bipartisan- bill-would-require-labeling-of-ai-generated-videos-and-audio . Ac- cessed: 2024-09-19. Fred Phillips and Brandy Mackintosh. Wiki art gallery, inc.: A case for critical thinking. Issues in Accounting Education, 26(3):593–608,

work page 2024
[8]

Accessed: 2024-09-19

URL https://www.reuters.com/technology/artificial-intelligence/ openai-supports-california-ai-bill-requiring-watermarking- synthetic-content-2024-08-26 . Accessed: 2024-09-19. Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF con...

work page 2024
[9]

ISBN 9798400701085

Association for Computing Machinery. ISBN 9798400701085. doi: 10.1145/3581783.3612471. URL https://doi. org/10.1145/3581783.3612471. Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shad- ing: Provable performance-lossless image watermarking for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vi...

arXiv
[10]

Robust invisible video watermarking with attention

Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. arXiv preprint arXiv:1909.01285,

arXiv 1909
[12]

Invisible image watermarks are provably removable using generative ai

Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative ai. arXiv preprint arXiv:2306.01953,

arXiv
[13]

The string s is then replicated fc · f 2 hw times and reshaped into its diffused version sd with the shape (c, h, w)

A A PPENDIX A.1 P RELIMINARY A.1.1 G AUSSIAN SHADING The watermark is a bit string s consisting of 0s and 1s, with a length defined as c fc · h fhw · w fhw , where c, h, and w represent the channels, height, and width of the Gaussian noise used for watermark injection, and fc, fhw are scaling factors for expansion. The string s is then replicated fc · f 2...

work page 2008

Show all 13 references

[2014]

Fixed-point inversion for text-to-image diffusion models

Barak Meiri, Dvir Samuel, Nir Darshan, Gal Chechik, Shai Avidan, and Rami Ben-Ari. Fixed-point inversion for text-to-image diffusion models. arXiv preprint arXiv:2312.12540,

arXiv
[2019]

Robust image watermarking using stable diffusion

Lijun Zhang, Xiao Liu, Antoni Viros Martin, Cindy Xiong Bearfield, Yuriy Brun, and Hui Guan. Robust image watermarking using stable diffusion. arXiv preprint arXiv:2401.04247,

arXiv
[2020]

Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification

Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification. arXiv preprint arXiv:2404.14055,

arXiv
[2023]

Accessed: 2024- 09-19

URL https: //www.europarl.europa.eu/topics/en/article/20230601STO93804/eu- ai-act-first-regulation-on-artificial-intelligence . Accessed: 2024- 09-19. Han Fang and et al. Pimog: An effective screen-shooting noise-layer simulation for deep-learning- based watermarking network. ...

2024
[2024]

Robust-wide: Robust watermarking against instruction-driven image editing

Runyi Hu, Jie Zhang, Tianwei Zhang, and Jiwei Li. Robust-wide: Robust watermarking against instruction-driven image editing. arXiv preprint arXiv:2402.12688,

arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [4]

Diffusetrace: A transparent and flexible water- marking scheme for latent diffusion model

11 Preprint Liangqi Lei, Keke Gai, Jing Yu, and Liehuang Zhu. Diffusetrace: A transparent and flexible water- marking scheme for latent diffusion model. arXiv preprint arXiv:2405.02696,

arXiv

[2] [5]

Microsoft coco: Common objects in context

Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll´ar, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer Vision–ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pp. 740–755. Springer,

2014

[3] [7]

Ac- cessed: 2024-09-19

URL https://www.pbs.org/newshour/politics/new-bipartisan- bill-would-require-labeling-of-ai-generated-videos-and-audio . Ac- cessed: 2024-09-19. Fred Phillips and Brandy Mackintosh. Wiki art gallery, inc.: A case for critical thinking. Issues in Accounting Education, 26(3):593–608,

work page 2024

[4] [8]

Accessed: 2024-09-19

URL https://www.reuters.com/technology/artificial-intelligence/ openai-supports-california-ai-bill-requiring-watermarking- synthetic-content-2024-08-26 . Accessed: 2024-09-19. Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF con...

work page 2024

[5] [9]

ISBN 9798400701085

Association for Computing Machinery. ISBN 9798400701085. doi: 10.1145/3581783.3612471. URL https://doi. org/10.1145/3581783.3612471. Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shad- ing: Provable performance-lossless image watermarking for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vi...

arXiv

[6] [10]

Robust invisible video watermarking with attention

Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. arXiv preprint arXiv:1909.01285,

arXiv 1909

[7] [12]

Invisible image watermarks are provably removable using generative ai

Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative ai. arXiv preprint arXiv:2306.01953,

arXiv

[8] [13]

The string s is then replicated fc · f 2 hw times and reshaped into its diffused version sd with the shape (c, h, w)

A A PPENDIX A.1 P RELIMINARY A.1.1 G AUSSIAN SHADING The watermark is a bit string s consisting of 0s and 1s, with a length defined as c fc · h fhw · w fhw , where c, h, and w represent the channels, height, and width of the Gaussian noise used for watermark injection, and fc, fhw are scaling factors for expansion. The string s is then replicated fc · f 2...

work page 2008