Pith. sign in

REVIEW 5 major objections 6 minor 1 cited by

Visual Watermarking in the Era of Diffusion Models: Advances and Challenges

T0 review · 5 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A survey maps diffusion-model watermarking into three camps: data-driven passive, sampling-driven passive, and adversarial proactive.

desk verdict A useful but sloppy survey map of diffusion watermarking, whose central taxonomy contradicts its own examples; fixable, worth peer review but not citable as authoritative. read the letter →

arxiv 2505.08197 v2 pith:SL5WAB6C submitted 2025-05-13 cs.CV

Junxian Duan , Jiyang Guan , Wenkui Yang , Ran He This is my paper · ORCID
classification cs.CV
keywords visualwatermarkingdiffusionmodelstext-to-imagegenerationcopyrightprotectionadversarialexamplesmodelprovenancewatermarkrobustnessgenerativeAIsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper is a survey of visual watermarking in the era of diffusion models. Its central claim is that current diffusion-model watermarking methods fall into three categories: passive methods that embed watermarks into training data, passive methods that modify the sampling process or decoder so generated images carry a traceable mark, and adversarial proactive methods that perturb images so diffusion models cannot usefully copy or edit them. The paper argues diffusion models change the watermarking problem qualitatively because the same denoising machinery that creates images can also strip small watermark perturbations, pushing robust designs into frequency-domain, latent-space, and semantic-level strategies. It introduces no new watermark itself; its contribution is a map of the field plus a list of open problems: computational cost, resistance to diffusion-based purification, and multi-user attribution.

What carries the argument

The organizing device is the three-category taxonomy anchored in the diffusion process itself. Equations (1)-(5) define the forward noising and learned denoising steps, and the taxonomy works by asking which step a method modifies: training data, initial latent, scheduler, decoder, or final image. The paper's exemplar for latent-level embedding is Tree-Ring, which places ring patterns in the Fourier space of the initial noise vector, putting the mark at the distributional level rather than the sample level; this is what lets a watermark survive spatial-domain denoising. The same pipeline map explains why adversarial proactive methods use iterative adversarial optimization: they must shift the image so that any downstream diffusion-based edit produces a visibly broken result.

What would settle it

Inspect the primary sources behind the taxonomy: if a substantial share of the cited methods are not accurately described by the paper's category definitions, starting with whether Tree-Ring's watermark is in the initial latent's Fourier coefficients rather than in image pixels, then the taxonomy and the challenge list built on it do not hold as a map of the literature.

Watch

Extended reading notes

Core claim

On the paper's own terms, the key organizing discovery is that the diffusion watermarking literature is structured by who is being protected and at which stage of the diffusion pipeline the mark enters. Data-driven passive methods protect data and model owners by hiding marks in training data or trigger pairs; sampling-driven passive methods modify the initial noise, the scheduler, or the decoder so that outputs carry a signature; adversarial proactive methods protect data owners by adding optimized perturbations that make images unrecognizable to unauthorized customization. The paper also claims this taxonomy exposes an asymmetry: diffusion models give defenders a flexible embedding mechanism, yet the same denoising capability gives attackers a purification mechanism, so watermark robustness has to be engineered against denoising and fine-tuning rather than only against conventional image processing.

Load-bearing premise

The survey's map is only as reliable as its characterizations of the cited methods; for example, defining passive watermarking as adding small noise to images misdescribes Tree-Ring, which modifies the initial latent's Fourier coefficients rather than adding noise to output pixels.

Editorial extensions

If this is right

  • A new method can be classified by answering two questions: who is protected (data owner or model owner) and where in the diffusion pipeline the mark is injected (data, sampling, decoder, or image).
  • Passive methods embedded during training or sampling add little or no per-image cost, while proactive adversarial methods pay for each sample with iterative optimization, so cost pressure should push adoption toward training-time and sampling-time designs.
  • Robustness evaluations should include diffusion-based purification and fine-tuning attacks, not just JPEG compression or cropping, because diffusion models can erase small perturbations while preserving image quality.
  • Binary model-level watermarking cannot identify individual users; multi-bit or multi-channel methods are required once attribution must name a specific user rather than a source model.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the taxonomy is accurate, the next wave of methods will hybridize the categories, for example by training an adversarial generator once to amortize the per-image cost of proactive marks, a direction the paper mentions as feasible but does not develop.
  • The paper's examples predict a testable ordering: latent-space and frequency-domain watermarks should survive diffusion purification better than pixel-space watermarks, and a systematic benchmark under purification and fine-tuning would confirm or refute this.
  • The passive/proactive split leaves a third notion implicit: watermarking as a differentiable part of the generative objective, where the model is trained to produce marked images by construction rather than marked afterwards.
  • If diffusion models keep improving at removing perturbations, the durable strategy implied by the paper is semantic-level modification, altering image content imperceptibly so the mark persists through regeneration, since high-frequency proactive marks are called out as ineffective.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. This paper is a survey of visual watermarking techniques in the context of diffusion models. It proposes a three-way taxonomy of current methods: data-driven passive methods, sampling-driven passive methods, and adversarial proactive methods. It then reviews representative methods for image and model copyright protection, discusses effectiveness and robustness, identifies challenges such as computational cost, watermark-removal attacks, and multi-user attribution, and outlines applications in copyright protection, forensics, and privacy. The paper presents no new algorithms or experiments; its contribution is intended to be an organizational map of the emerging diffusion-watermarking literature.

Significance. If the taxonomy and method summaries were accurate, the survey would be a useful entry point to a rapidly growing and practically important area. The paper correctly states the DDPM/LDM training objectives in Eqs. (1)–(5), covers influential methods including Tree-Ring, Stable Signature, WOUAF, RingID, AdvDM, Glaze, and Anti-DB, and identifies real challenges such as denoising-based watermark removal (DiffPure/GrIDPure) and multi-key attribution. However, the paper's central value depends on the correctness of its categorization, and the categories are currently defined inconsistently with the cited methods. Because the challenge discussion in Section 4 is built on these categories, the inconsistencies propagate to the paper's main contributions. The issues are fixable within the scope of a survey, but they require substantive revision rather than copy editing.

major comments (5)
  1. [§3.1] Section 3.1 (repeated in Section 3.3 and Section 4.2) defines passive watermarking as 'adding small noise to images' and proactive watermarking as 'adversarial optimization to introduce noise into images.' These definitions are contradicted by the paper's own examples: Stable Signature fine-tunes the LDM decoder, Tree-Ring embeds rings in the Fourier coefficients of the initial latent noise vector, and NaiveWM/FixedWM inject keywords into prompts. Since Section 2.2's taxonomy and Table 1 are built on these definitions, the central classification of methods is not currently an accurate map of the literature.
  2. [§2.2, Table 1, §5.1] Section 2.2 assigns 'full training methods' the citation [Zhao et al., 2023a] and says such methods embed watermarks into the entire pretraining dataset, while Table 1 and Section 5.1 describe Recipe [Zhao et al., 2023a] as fine-tuning a pre-trained diffusion model with trigger pairs, which is the backdoor-attack subcategory that Section 2.2 attributes to [Liu et al., 2023]. The same method is thus placed in two different subcategories of the same taxonomy, making the taxonomy self-contradictory.
  3. [Table 1] Table 1 lists GrIDPure [Zhao et al., 2024b] under 'PW for Image' as a watermarking method whose description is 'discloses the vulnerability of existing watermarking methods.' GrIDPure is a watermark-removal/purification attack rather than a watermark-embedding method. Including it in the representative method list conflates attacks with defenses and undermines the claim that the table represents watermarking methods.
  4. [§3.1, §4.3] Section 3.1 and Table 1 classify AdvDM, Glaze, Anti-DB, MetaCloak, and SIMAC as 'proactive watermarking,' but these methods carry no payload and define no watermark decoder; they produce adversarial examples that degrade downstream generation. The paper does not state whether it considers these methods to be watermarks or unlearnable-example defenses, and Section 4.3's discussion of multi-attribution assumes a decoder-based verification pipeline that these methods do not possess, so the challenge discussion does not apply uniformly to the methods listed under 'proactive watermarking.'
  5. [Abstract, Section 6] The Abstract claims that diffusion models 'enhance detection accuracy' and the Conclusion claims 'superior robustness and adaptability,' but the survey contains no experiments, benchmarks, or quantitative comparisons, and Sections 2–5 do not substantiate these comparative strength claims. Either the claims should be tempered to match what the survey actually shows, or the authors should cite specific quantitative evidence from the literature to support them.
minor comments (6)
  1. [Table 1] The Table 1 caption contains a typo: 'Representive' should be 'Representative'; similar typos appear in Section 3.2 ('diffsusion') and Section 4.3 ('indentification').
  2. [References] The ROBIN reference [Huang et al., ] is missing its publication year and venue; the citation is incomplete and should be finished before publication.
  3. [Eq. (2)] Equation (2) defines α_t as a product over i=0 to t, but β_0 is not defined; the standard DDPM convention is a product over i=1 to t. The indexing should be corrected.
  4. [§5.2] In Section 5.2, the sentence fragment 'like adversarial watermarking, can serve as a potential solution' lacks a grammatical subject and should be rewritten.
  5. [§3.2, Table 1] The name of SIMAC is written as 'SimAC' in Section 3.2 and 'SIMAC' in Table 1; the authors should use a single consistent spelling.
  6. [§1, §6] The paper cites the SoK paper [Zhao et al., 2024a] but does not explicitly state how this survey differs from or complements that existing systematization; a short positioning paragraph would clarify the novel contribution.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: this survey derives no predictions from fitted inputs and relies on no load-bearing self-citations.

full rationale

This is a survey paper rather than a derivation-driven methods paper. Its central content is a taxonomy of diffusion-model watermarking methods in Section 2.2 and Table 1, plus a discussion of effectiveness, robustness, challenges, and applications in Sections 3 through 6. There are no fitted parameters, no benchmark experiments, and no quantities that are predicted from, and therefore reducible to, their own inputs. The paper does not invoke any prior result by the present authors: Duan, Guan, Yang, and He are not the authors of any cited load-bearing reference, so the self-citation patterns are absent. The taxonomy definitions are not circular in the technical sense; they are organizing descriptions, and the later challenges are argued rather than derived. There are internal accuracy problems, such as Section 3.1 defining passive watermarking as adding small noise to images while the paper itself describes Tree-Ring as embedding rings in the Fourier space of the initial noise vector, and Section 2.2 describing data-driven full-training methods in a way that conflicts with Section 5.1's account of Recipe as trigger-pair fine-tuning, but these are correctness and consistency concerns about how accurately the cited methods are summarized, not circular reasoning. The statement in Section 4.2 that watermark removal is treated as an attack is a framing choice, not a derived claim. Because the paper makes no claim that reduces by construction to its own definitions or to a self-citation chain, the appropriate circularity score is 0.

Assumptions & free parameters 0 free parameters · 2 assumptions · 0 invented entities

No free parameters are fitted and no new entities are introduced because the paper is a review. Its load-bearing content is the accuracy of the standard diffusion background and the fidelity of its summaries of prior methods. Section 3.1 and Table 1 are where these assumptions do their work.

assumptions (2)
  • standard math Standard DDPM/LDM equations (Eqs. 1-5) correctly describe the diffusion process used by Stable Diffusion.
    The survey relies on these textbook definitions to frame all discussed methods; they are standard and uncontroversial.
  • domain assumption The cited watermarking methods are accurately and representatively summarized.
    The paper performs no experiments or formal verification, so its taxonomy and challenge list depend on faithful readings of Tree-Ring, Stable Signature, Glaze, AdvDM, and other cited works.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Visual Watermarking in the Era of Diffusion Models: Advances and Challenges." pith.science (2026). https://pith.science/paper/SL5WAB6C

@misc{pith2026250508197,
  author       = {Pith},
  title        = {Pith review of: Visual Watermarking in the Era of Diffusion Models: Advances and Challenges},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SL5WAB6C}},
  note         = {Machine review of arXiv:2505.08197}
}
read the original abstract

As generative artificial intelligence technologies like Stable Diffusion advance, visual content becomes more vulnerable to misuse, raising concerns about copyright infringement. Visual watermarks serve as effective protection mechanisms, asserting ownership and deterring unauthorized use. Traditional deepfake detection methods often rely on passive techniques that struggle with sophisticated manipulations. In contrast, diffusion models enhance detection accuracy by allowing for the effective learning of features, enabling the embedding of imperceptible and robust watermarks. We analyze the strengths and challenges of watermark techniques related to diffusion models, focusing on their robustness and application in watermark generation. By exploring the integration of advanced diffusion models and watermarking security, we aim to advance the discourse on preserving watermark robustness against evolving forgery threats. It emphasizes the critical importance of developing innovative solutions to protect digital content and ensure the preservation of ownership rights in the era of generative AI.

Figures

Figures reproduced from arXiv: 2505.08197 by the authors.

Figure 1
Figure 1. Three common workflows for DMs watermarking. (Top) [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. First-Place Solution to NeurIPS 2024 Invisible Watermark Removal Challenge

    cs.CV 2025-08 conditional novelty 4.0 of 10

    A competition-winning pipeline removes 95.7% of StegaStamp and TreeRing watermarks on the NeurIPS 2024 benchmark by combining VAE fine-tuning, diffusion purification, and translation tricks.

Reference graph

Works this paper leans on

44 extracted references · 31 canonical work pages · cited by 1 Pith paper

  1. [1]

    Waves: Benchmarking the ro- bustness of image watermarks

    [Bang et al., 2024] An Bang, Ding Mucong, Rabbani Tah- seen, Agrawal Aakriti, Xu Yuancheng, Deng Chenghao, Zhu Sicheng, Mohamed Abdirisak, Wen Yuxin, Goldstein Tom, and Huang Furong. Waves: Benchmarking the ro- bustness of image watermarks. In International Confer- ence on Machine Learning, page

    work page 2024

  2. [3]

    Targeted backdoor attacks on deep learning systems using data poisoning.arXiv preprint arXiv:1712.05526,

    [Chen et al., 2017] Xinyun Chen, Chang Liu, Bo Li, Kim- berly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning.arXiv preprint arXiv:1712.05526,

    arXiv 2017

  3. [5]

    Secure spread spectrum wa- termarking for multimedia

    [Cox et al., 1997] Ingemar J Cox, Joe Kilian, F Thomson Leighton, and Talal Shamoon. Secure spread spectrum wa- termarking for multimedia. IEEE Transactions on Image Processing, 6(12):1673–1687,

    work page 1997

  4. [7]

    The stable signature: Rooting watermarks in latent diffusion models

    [Fernandez et al., 2023] Pierre Fernandez, Guillaume Coua- iron, Herv´e J´egou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In IEEE International Conference on Computer Vision, pages 22466–22477,

    work page 2023

  5. [10]

    Robin: Robust and invisible watermarks for diffusion models with adversarial optimization

    [Huang et al., ] Huayang Huang, Yu Wu, and Qian Wang. Robin: Robust and invisible watermarks for diffusion models with adversarial optimization. In Conference on Neural Information Processing Systems. [Huang et al., 2022] Hao Huang, Yongtao Wang, Zhaoyu Chen, Yuze Zhang, Yuheng Li, Zhi Tang, Wei Chu, Jing- dong Chen, Weisi Lin, and Kai-Kuang Ma. Cmua- wat...

    work page 2022

  6. [12]

    Conceptwm: A diffusion model watermark for concept protection

    [Lei et al., 2024] Liangqi Lei, Keke Gai, Jing Yu, Liehuang Zhu, and Qi Wu. Conceptwm: A diffusion model watermark for concept protection. arXiv preprint arXiv:2411.11688,

    arXiv 2024

  7. [13]

    Diffusion models for non-autoregressive text generation: A survey

    [Li et al., 2023] Yifan Li, Kun Zhou, Wayne Xin Zhao, and Ji-Rong Wen. Diffusion models for non-autoregressive text generation: A survey. In International Joint Confer- ence on Artificial Intelligence, pages 6692–6701,

    work page 2023

  8. [14]

    Shallow diffuse: Robust and invisible watermarking through low-dimensional subspaces in diffusion models

    [Li et al., 2024] Wenda Li, Huijie Zhang, and Qing Qu. Shallow diffuse: Robust and invisible watermarking through low-dimensional subspaces in diffusion models. arXiv preprint arXiv:2410.21088,

    arXiv 2024

Show all 44 references
  1. [15]

    Mist: Towards improved adversarial examples for diffu- sion models

    [Liang and Wu, 2023] Chumeng Liang and Xiaoyu Wu. Mist: Towards improved adversarial examples for diffu- sion models. arXiv preprint arXiv:2305.12683,

    2023 arXiv

  2. [16]

    Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples

    [Liang et al., 2023] Chumeng Liang, Xiaoyu Wu, Yang Hua, Jiaru Zhang, Yiming Xue, Tao Song, Zhengui Xue, Ruhui Ma, and Haibing Guan. Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples. In International Conference on Ma- ...

    2023

  3. [17]

    Watermarking diffusion model

    [Liu et al., 2023] Yugeng Liu, Zheng Li, Michael Backes, Yun Shen, and Yang Zhang. Watermarking diffusion model. arXiv preprint arXiv:2305.12502,

    2023 arXiv

  4. [18]

    Metacloak: Preventing unauthorized subject-driven text-to-image diffusion-based synthesis via meta-learning

    [Liu et al., 2024] Yixin Liu, Chenrui Fan, Yutong Dai, Xun Chen, Pan Zhou, and Lichao Sun. Metacloak: Preventing unauthorized subject-driven text-to-image diffusion-based synthesis via meta-learning. In IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 242...

    2024

  5. [19]

    Distortion ag- nostic deep watermarking

    [Luo et al., 2020] Xiyang Luo, Ruohan Zhan, Huiwen Chang, Feng Yang, and Peyman Milanfar. Distortion ag- nostic deep watermarking. In IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 13548– 13557,

    2020

  6. [20]

    Towards deep learning models resistant to adversarial attacks

    [Madry et al., 2018] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations,

    2018

  7. [22]

    Intellectual property protection of diffusion models via the watermark diffusion process

    [Peng et al., 2025] Sen Peng, Yufei Chen, Cong Wang, and Xiaohua Jia. Intellectual property protection of diffusion models via the watermark diffusion process. In Interna- tional Conference on Web Information Systems Engineer- ing, pages 290–305. Springer,

    2025

  8. [25]

    Dreambooth: Fine tuning text-to-image diffusion mod- els for subject-driven generation

    [Ruiz et al., 2023] Nataniel Ruiz, Yuanzhen Li, Varun Jam- pani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dreambooth: Fine tuning text-to-image diffusion mod- els for subject-driven generation. In IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition , pag...

    2023

  9. [26]

    Raising the cost of malicious ai-powered image editing

    [Salman et al., 2023] Hadi Salman, Alaa Khaddaj, Guil- laume Leclerc, Andrew Ilyas, and Aleksander Madry. Raising the cost of malicious ai-powered image editing. arXiv preprint arXiv:2302.06588,

    2023 arXiv

  10. [27]

    Glaze: Protecting artists from style mimicry by {Text-to- Image} models

    [Shan et al., 2023] Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y Zhao. Glaze: Protecting artists from style mimicry by {Text-to- Image} models. In USENIX Security Symposium , pages 2187–2204,

    2023

  11. [28]

    Deep unsupervised learning using nonequilibrium thermody- namics

    [Sohl-Dickstein et al., 2015] Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermody- namics. In International Conference on Machine Learn- ing, pages 2256–2265. PMLR,

    2015

  12. [30]

    Deceiving image-to-image translation networks for autonomous driving with adversarial perturbations

    [Wang et al., 2020] Lin Wang, Wonjune Cho, and Kuk-Jin Yoon. Deceiving image-to-image translation networks for autonomous driving with adversarial perturbations. IEEE Robotics and Automation Letters, 5(2):1421–1428,

    2020

  13. [31]

    Simac: A simple anti- customization method for protecting face privacy against text-to-image synthesis of diffusion models

    [Wang et al., 2024] Feifei Wang, Zhentao Tan, Tianyi Wei, Yue Wu, and Qidong Huang. Simac: A simple anti- customization method for protecting face privacy against text-to-image synthesis of diffusion models. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, pa...

    2024

  14. [32]

    Tree-ring watermarks: Fin- gerprints for diffusion images that are invisible and robust

    [Wen et al., 2023] Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fin- gerprints for diffusion images that are invisible and robust. arXiv preprint arXiv:2305.20030,

    2023 arXiv

  15. [33]

    Flexible and secure watermarking for latent diffusion model

    [Xiong et al., 2023] Cheng Xiong, Chuan Qin, Guorui Feng, and Xinpeng Zhang. Flexible and secure watermarking for latent diffusion model. In ACM International Conference on Multimedia, pages 1668–1676,

    2023

  16. [34]

    Toward effective protection against diffusion-based mimicry through score distillation

    [Xue et al., 2023] Haotian Xue, Chumeng Liang, Xiaoyu Wu, and Yongxin Chen. Toward effective protection against diffusion-based mimicry through score distillation. In International Conference on Learning Representations,

    2023

  17. [35]

    Gaus- sian shading: Provable performance-lossless image wa- termarking for diffusion models

    [Yang et al., 2024] Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaus- sian shading: Provable performance-lossless image wa- termarking for diffusion models. In IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition , pages 12162–12171,

    2024

  18. [36]

    Duaw: Data-free universal adversarial wa- termark against stable diffusion customization

    [Ye et al., 2024] Xiaoyu Ye, Hao Huang, Jiaqi An, and Yongtao Wang. Duaw: Data-free universal adversarial wa- termark against stable diffusion customization. InInterna- tional Conference on Learning Representations Workshop on Secure and Trustworthy Large Language Models,

    2024

  19. [37]

    Diffforensics: Leveraging diffusion prior to image forgery detection and localization

    [Yu et al., 2024] Zeqin Yu, Jiangqun Ni, Yuzhen Lin, Haoyi Deng, and Bin Li. Diffforensics: Leveraging diffusion prior to image forgery detection and localization. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12765–12774,

    2024

  20. [38]

    Robust in- visible video watermarking with attention

    [Zhang et al., 2019] Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Robust in- visible video watermarking with attention. arXiv preprint arXiv:1909.01285,

    2019 arXiv

  21. [40]

    A recipe for watermarking diffusion models

    [Zhao et al., 2023a] Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Ngai-Man Cheung, and Min Lin. A recipe for watermarking diffusion models. arXiv preprint arXiv:2303.10137,

    arXiv

  22. [41]

    Unlearnable examples for diffusion mod- els: Protect data from unauthorized exploitation

    [Zhao et al., 2023b] Zhengyue Zhao, Jinhao Duan, Xing Hu, Kaidi Xu, Chenan Wang, Rui Zhang, Zidong Du, Qi Guo, and Yunji Chen. Unlearnable examples for diffusion mod- els: Protect data from unauthorized exploitation. arXiv preprint arXiv:2306.01902,

    arXiv

  23. [42]

    Sok: Watermarking for ai-generated content

    [Zhao et al., 2024a] Xuandong Zhao, Sam Gunn, Miranda Christ, Jaiden Fairoze, Andres Fabrega, and et al. Sok: Watermarking for ai-generated content. arXiv preprint arXiv:2411.18479,

    arXiv

  24. [43]

    Watermark-embedded adversarial ex- amples for copyright protection against diffusion models

    [Zhu et al., 2024] Peifei Zhu, Tsubasa Takahashi, and Hi- rokatsu Kataoka. Watermark-embedded adversarial ex- amples for copyright protection against diffusion models. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24420–24430,

    2024

  25. [44]

    Hidden: hiding data with deep networks

    [Zhu, 2018] J Zhu. Hidden: hiding data with deep networks. arXiv preprint arXiv:1807.09937, 2018

    2018 arXiv

  26. [1997]

    Scalable watermarking for identifying large language model outputs

    [Dathathri et al., 2024] Sumanth Dathathri, Abigail See, Sumedh Ghaisas, Po-Sen Huang, Rob McAdam, and et al. Scalable watermarking for identifying large language model outputs. In Nature, volume 634, pages 818–823,

    2024

  27. [1999]

    High-resolution image synthesis with latent diffusion models

    [Rombach et al., 2022] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High-resolution image synthesis with latent diffusion models. In IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 10684–10695,

    2022

  28. [2015]

    Anti-dreambooth: Protecting users from personalized text-to-image synthesis

    [Van Le et al., 2023] Thanh Van Le, Hao Phung, Thuan Hoang Nguyen, Quan Dao, Ngoc N Tran, and Anh Tran. Anti-dreambooth: Protecting users from personalized text-to-image synthesis. In IEEE Interna- tional Conference on Computer Vision, pages 2116–2127,

    2023

  29. [2017]

    Ringid: Rethinking tree-ring water- marking for enhanced multi-key identification

    [Ci et al., 2024] Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. Ringid: Rethinking tree-ring water- marking for enhanced multi-key identification. In Eu- ropean Conference on Computer Vision , pages 338–354. Springer,

    2024

  30. [2018]

    Diffusion models for adversarial purification

    [Nie et al., 2022] Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Animashree Anandku- mar. Diffusion models for adversarial purification. In International Conference on Machine Learning , pages 16805–16827. PMLR,

    2022

  31. [2019]

    Udh: Univer- sal deep hiding for steganography, watermarking, and light field messaging

    [Zhang et al., 2020] Chaoning Zhang, Philipp Benz, Adil Karjauv, Geng Sun, and In So Kweon. Udh: Univer- sal deep hiding for steganography, watermarking, and light field messaging. In Conference on Neural Informa- tion Processing Systems, volume 33, pages 10223–10234,

    2020

  32. [2020]

    In- evitable trade-off between watermark strength and specu- lative sampling efficiency for language models

    [Hu and Huang, 2024] Zhengmian Hu and Heng Huang. In- evitable trade-off between watermark strength and specu- lative sampling efficiency for language models. InConfer- ence on Neural Information Processing Systems,

    2024

  33. [2022]

    Wouaf: Weight modulation for user attribution and fingerprinting in text- to-image diffusion models

    [Kim et al., 2024] Changhoon Kim, Kyle Min, Maitreya Pa- tel, Sheng Cheng, and Yezhou Yang. Wouaf: Weight modulation for user attribution and fingerprinting in text- to-image diffusion models. In IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 8974– 8983,

    2024

  34. [2023]

    Denoising diffusion probabilistic models

    [Ho et al., 2020] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In Conference on Neural Information Processing Systems , volume 33, pages 6840–6851,

    2020

  35. [2024]

    Pluggable watermarking of deepfake models for deepfake detection

    [Bao et al., 2024] Han Bao, Xuhong Zhang, Qinying Wang, Kangming Liang, Zonghui Wang, Shouling Ji, and Wen- zhi Chen. Pluggable watermarking of deepfake models for deepfake detection. In International Joint Conference on Artificial Intelligence, pages 331–339,

    2024

  36. [2025]

    Information hiding-a survey

    [Petitcolas et al., 1999] Fabien AP Petitcolas, Ross J Ander- son, and Markus G Kuhn. Information hiding-a survey. Proceedings of the IEEE, 87(7):1062–1078,

    1999

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.