# Supervised GAN Watermarking for Intellectual Property Protection

arXiv: https://arxiv.org/abs/2209.03466 · HTML: https://mlsanity.com/paper/2209.03466/

## Key facts

- Cited by 40 papers in the map (data through 14 Oct 2026).
- Builds on 14 of its 26 references that are in the map.
- First posted on arXiv 7 Sep 2022.

## Builds on (most cited first, 14 of 14)

- [A Style-Based Generator Architecture for Generative Adversarial Networks](https://mlsanity.com/paper/1812.04948/) (2018)
- [Image-to-Image Translation with Conditional Adversarial Networks](https://mlsanity.com/paper/1611.07004/) (2016)
- [Deep Learning Face Attributes in the Wild](https://mlsanity.com/paper/1411.7766/) (2014)
- [Analyzing and Improving the Image Quality of StyleGAN](https://mlsanity.com/paper/1912.04958/) (2019)
- [Progressive Growing of GANs for Improved Quality, Stability, and Variation](https://mlsanity.com/paper/1710.10196/) (2017)
- [LSUN: Construction of a Large-scale Image Dataset using Deep Learning with Humans in the Loop](https://mlsanity.com/paper/1506.03365/) (2015)
- [HiDDeN: Hiding Data With Deep Networks](https://mlsanity.com/paper/1807.09937/) (2018)
- [Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring](https://mlsanity.com/paper/1802.04633/) (2018)
- [StegaStamp: Invisible Hyperlinks in Physical Photographs](https://mlsanity.com/paper/1904.05343/) (2019)
- [Embedding Watermarks into Deep Neural Networks](https://mlsanity.com/paper/1701.04082/) (2017)
- [Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution in Training Data](https://mlsanity.com/paper/2007.08457/) (2020)
- [A survey of deep neural network watermarking techniques](https://mlsanity.com/paper/2103.09274/) (2021)
- [Protecting Intellectual Property of Generative Adversarial Networks from Ambiguity Attack](https://mlsanity.com/paper/2102.04362/) (2021)
- [Spread-Transform Dither Modulation Watermarking of Deep Neural Network](https://mlsanity.com/paper/2012.14171/) (2020)

## Built on by (most cited first, 30 of 40)

- [The Stable Signature: Rooting Watermarks in Latent Diffusion Models](https://mlsanity.com/paper/2303.15435/) (2023)
- [Self-Consuming Generative Models Go MAD](https://mlsanity.com/paper/2307.01850/) (2023)
- [Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust](https://mlsanity.com/paper/2305.20030/) (2023)
- [A Recipe for Watermarking Diffusion Models](https://mlsanity.com/paper/2303.10137/) (2023)
- [Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models](https://mlsanity.com/paper/2311.04378/) (2023)
- [Watermark Anything with Localized Messages](https://mlsanity.com/paper/2411.07231/) (2024)
- [CO-SPY: Combining Semantic and Pixel Features to Detect Synthetic Images by AI](https://mlsanity.com/paper/2503.18286/) (2025)
- [Copyright Protection in Generative AI: A Technical Perspective](https://mlsanity.com/paper/2402.02333/) (2024)
- [A Survey on ChatGPT: AI-Generated Contents, Challenges, and Solutions](https://mlsanity.com/paper/2305.18339/) (2023)
- [Watermark-embedded Adversarial Examples for Copyright Protection against Diffusion Models](https://mlsanity.com/paper/2404.09401/) (2024)
- [Intellectual Property Protection of Diffusion Models via the Watermark Diffusion Process](https://mlsanity.com/paper/2306.03436/) (2023)
- [Copyright Protection and Accountability of Generative AI:Attack, Watermarking and Attribution](https://mlsanity.com/paper/2303.09272/) (2023)
- [Challenges and Remedies to Privacy and Security in AIGC: Exploring the Potential of Privacy Computing, Blockchain, and Beyond](https://mlsanity.com/paper/2306.00419/) (2023)
- [SoK: On the Role and Future of AIGC Watermarking in the Era of Gen-AI](https://mlsanity.com/paper/2411.11478/) (2024)
- [Wide Flat Minimum Watermarking for Robust Ownership Verification of GANs](https://mlsanity.com/paper/2310.16919/) (2023)
- [Warfare:Breaking the Watermark Protection of AI-Generated Content](https://mlsanity.com/paper/2310.07726/) (2023)
- [FreqMark: Invisible Image Watermarking via Frequency Based Optimization in Latent Space](https://mlsanity.com/paper/2410.20824/) (2024)
- [Invisible Watermarking for Audio Generation Diffusion Models](https://mlsanity.com/paper/2309.13166/) (2023)
- [Deepfake Media Forensics: State of the Art and Challenges Ahead](https://mlsanity.com/paper/2408.00388/) (2024)
- [Adversarial Robustness of AI-Generated Image Detectors in the Real World](https://mlsanity.com/paper/2410.01574/) (2024)
- [Robust Retraining-free GAN Fingerprinting via Personalized Normalization](https://mlsanity.com/paper/2311.05478/) (2023)
- [Safe-VAR: Safe Visual Autoregressive Model for Text-to-Image Generative Watermarking](https://mlsanity.com/paper/2503.11324/) (2025)
- [Investigating Deep Watermark Security: An Adversarial Transferability Perspective](https://mlsanity.com/paper/2402.16397/) (2024)
- [Evaluating Durability: Benchmark Insights into Multimodal Watermarking](https://mlsanity.com/paper/2406.03728/) (2024)
- [Hide and Seek: How Does Watermarking Impact Face Recognition?](https://mlsanity.com/paper/2404.18890/) (2024)
- [Hiding Images in Diffusion Models by Editing Learned Score Functions](https://mlsanity.com/paper/2503.18459/) (2025)
- [The Coding Limits of Robust Watermarking for Generative Models](https://mlsanity.com/paper/2509.10577/) (2025)
- [SpecGuard: Spectral Projection-based Advanced Invisible Watermarking](https://mlsanity.com/paper/2510.07302/) (2025)
- [Reversible Quantization Index Modulation for Static Deep Neural Network Watermarking](https://mlsanity.com/paper/2305.17879/) (2023)
- [An Efficient Watermarking Method for Latent Diffusion Models via Low-Rank Adaptation and Dynamic Loss Weighting](https://mlsanity.com/paper/2410.20202/) (2024)

## Abstract (arXiv)

We propose a watermarking method for protecting the Intellectual Property (IP) of Generative Adversarial Networks (GANs). The aim is to watermark the GAN model so that any image generated by the GAN contains an invisible watermark (signature), whose presence inside the image can be checked at a later stage for ownership verification. To achieve this goal, a pre-trained CNN watermarking decoding block is inserted at the output of the generator. The generator loss is then modified by including a watermark loss term, to ensure that the prescribed watermark can be extracted from the generated images. The watermark is embedded via fine-tuning, with reduced time complexity. Results show that our method can effectively embed an invisible watermark inside the generated images. Moreover, our method is a general one and can work with different GAN architectures, different tasks, and different resolutions of the output image. We also demonstrate the good robustness performance of the embedded watermark against several post-processing, among them, JPEG compression, noise addition, blurring, and color transformations.