mlsanityData to 7 Oct 2026

A Recipe for Watermarking Diffusion Models

arXiv 2303.10137 ↗First posted 17 Mar 2023cs.CV cs.CR cs.LGcited by 136

On the map: Diffusion models → Robustness, privacy and adversarial aspects

also in 1 more
Abstract (arXiv)

Diffusion models (DMs) have demonstrated advantageous potential on generative tasks. Widespread interest exists in incorporating DMs into downstream applications, such as producing or editing photorealistic images. However, practical deployment and unprecedented power of DMs raise legal issues, including copyright protection and monitoring of generated content. In this regard, watermarking has been a proven solution for copyright protection and content monitoring, but it is underexplored in the DMs literature. Specifically, DMs generate samples from longer tracks and may have newly designed multimodal structures, necessitating the modification of conventional watermarking pipelines. To this end, we conduct comprehensive analyses and derive a recipe for efficiently watermarking state-of-the-art DMs (e.g., Stable Diffusion), via training from scratch or finetuning. Our recipe is straightforward but involves empirically ablated implementation details, providing a foundation for future research on watermarking DMs. The code is available at https://github.com/yunqing-me/WatermarkDM.

Key facts. Cited by 136 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 56 of its 80 references that are in the map. First posted on arXiv 17 Mar 2023.

Builds on

56 of 80 references.

References · 56

  1. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  2. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  3. 2020Language Models are Few-Shot Learnerscited by 32,199
  4. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  5. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  6. 2020Denoising Diffusion Implicit Modelscited by 9,655
  7. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
  8. 2019Momentum Contrast for Unsupervised Visual Representation Learningcited by 7,482
  9. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,005
  10. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,539
  11. 2018A Style-Based Generator Architecture for Generative Adversarial Networkscited by 5,986
  12. 2023Adding Conditional Control to Text-to-Image Diffusion Modelscited by 5,466
38 more
  1. 2017Neural Discrete Representation Learningcited by 4,650
  2. 2022LAION-5B: An open large-scale dataset for training next generation image-text modelscited by 4,131
  3. 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,067
  4. 2021GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Modelscited by 3,595
  5. 2022DreamBooth: Fine Tuning Text-to-Image Diffusion Models for Subject-Driven Generationcited by 3,286
  6. 2022Elucidating the Design Space of Diffusion-Based Generative Modelscited by 2,994
  7. 2018Large Scale GAN Training for High Fidelity Natural Image Synthesiscited by 2,609
  8. 2022An Image is Worth One Word: Personalizing Text-to-Image Generation using Textual Inversioncited by 2,231
  9. 2022DPM-Solver: A Fast ODE Solver for Diffusion Probabilistic Model Sampling in Around 10 Stepscited by 1,961
  10. 2020Training Generative Adversarial Networks with Limited Datacited by 1,184
  11. 2021Variational Diffusion Modelscited by 1,145
  12. 2019StarGAN v2: Diverse Image Synthesis for Multiple Domainscited by 1,095
  13. 2020Improved Techniques for Training Score-Based Generative Modelscited by 1,036
  14. 2023A Watermark for Large Language Modelscited by 667
  15. 2019Quantifying the Carbon Emissions of Machine Learningcited by 516
  16. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  17. 2022Analytic-DPM: an Analytic Estimate of the Optimal Reverse Variance in Diffusion Probabilistic Modelscited by 331
  18. 2017Embedding Watermarks into Deep Neural Networkscited by 227
  19. 2020Media Forensics and DeepFakes: an overviewcited by 208
  20. 2021Few-shot Image Generation via Cross-domain Correspondencecited by 206
  21. 2020Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution in Training Datacited by 200
  22. 2020Entangled Watermarks as a Defense against Model Extractioncited by 144
  23. 2020Few-shot Image Generation with Elastic Weight Consolidationcited by 122
  24. 2017Adversarial Frontier Stitching for Remote Neural Network Watermarkingcited by 110
  25. 2019DAWN: Dynamic Adversarial Watermarking of Neural Networkscited by 94
  26. 2019Deep Neural Network Fingerprinting by Conferrable Adversarial Examplescited by 90
  27. 2019[Extended version] Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attackscited by 82
  28. 2021A survey of deep neural network watermarking techniquescited by 69
  29. 2019How to Prove Your Model Belongs to You: A Blind-Watermark based Framework to Protect Intellectual Property of DNNcited by 58
  30. 2020Countering Language Drift with Seeded Iterated Learningcited by 57
  31. 2022A Closer Look at Few-shot Image Generationcited by 49
  32. 2019Robust Watermarking of Neural Network with Exponential Weightingcited by 48
  33. 2021Protecting Intellectual Property of Generative Adversarial Networks from Ambiguity Attackcited by 45
  34. 2021One-Shot Generative Domain Adaptationcited by 41
  35. 2022Supervised GAN Watermarking for Intellectual Property Protectioncited by 39
  36. 2020WAFFLE: Watermarking in Federated Learningcited by 34
  37. 2022Few-shot Image Generation via Adaptation-Aware Kernel Modulationcited by 33
  38. 2019BlackMarks: Blackbox Multibit Watermarking for Deep Neural Networkscited by 25

50 most cited of 56 All 56 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 32; 2024: 47; 2025: 32; 2026: 25.

136 papers.

Sort:

By area:

  1. 2023On Evaluating Adversarial Robustness of Large Vision-Language Modelscited by 281
  2. 2023Generating Images with Multimodal Language Modelscited by 259
  3. 2023Self-Consuming Generative Models Go MADcited by 239
  4. 2023Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robustcited by 179
  5. 2023On Memorization in Diffusion Modelscited by 122
  6. 2023EditGuard: Versatile Image Watermarking for Tamper Localization and Copyright Protectioncited by 109
  7. 2024Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advancescited by 105
  8. 2023Text-to-Image Diffusion Models can be Easily Backdoored through Multimodal Data Poisoningcited by 91
  9. 2024WAVES: Benchmarking the Robustness of Image Watermarkscited by 89
  10. 2024RingID: Rethinking Tree-Ring Watermarking for Enhanced Multi-Key Identificationcited by 87
  11. 2023Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Modelscited by 77
  12. 2023Robustness of AI-Image Detectors: Fundamental Limits and Practical Attackscited by 75
38 more
  1. 2023A Survey on Detection of LLMs-Generated Contentcited by 70
  2. 2023Toward effective protection against diffusion based mimicry through score distillationcited by 64
  3. 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 63
  4. 2023WOUAF: Weight Modulation for User Attribution and Fingerprinting in Text-to-Image Diffusion Modelscited by 51
  5. 2023Advancing Beyond Identification: Multi-bit Watermark for Large Language Modelscited by 51
  6. 2023Leveraging Optimization for Adaptive Attacks on Image Watermarkscited by 50
  7. 2024Watermark Anything with Localized Messagescited by 49
  8. 2024ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimizationcited by 45
  9. 2023Improving Diffusion Models for Scene Text Editing with Dual Encoderscited by 44
  10. 2024Image Watermarks are Removable Using Controllable Regeneration from Clean Noisecited by 43
  11. 2024SoK: Watermarking for AI-Generated Contentcited by 43
  12. 2024AquaLoRA: Toward White-box Protection for Customized Stable Diffusion Models via Watermark LoRAcited by 42
  13. 2023DiffusionShield: A Watermark for Copyright Protection against Generative Diffusion Modelscited by 41
  14. 2023Mirror Diffusion Models for Constrained and Watermarked Generationcited by 38
  15. 2024Membership Inference on Text-to-Image Diffusion Models via Conditional Likelihood Discrepancycited by 38
  16. 2024Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attackscited by 37
  17. 2024Copyright Protection in Generative AI: A Technical Perspectivecited by 35
  18. 2024A Watermark-Conditioned Diffusion Model for IP Protectioncited by 34
  19. 2024The Stronger the Diffusion Model, the Easier the Backdoor: Data Poisoning to Induce Copyright Breaches Without Adjusting Finetuning Pipelinecited by 33
  20. 2024Attack-Resilient Image Watermarking Using Stable Diffusioncited by 33
  21. 2024On the Challenges and Opportunities in Generative AIcited by 31
  22. 2024WMAdapter: Adding WaterMark Control to Latent Diffusion Modelscited by 29
  23. 2024LaWa: Using Latent Space for In-Generation Image Watermarkingcited by 27
  24. 2024SleeperMark: Towards Robust Watermark against Fine-Tuning Text-to-image Diffusion Modelscited by 26
  25. 2024Purifying Large Language Models by Ensembling a Small Language Modelcited by 25
  26. 2024DiffuseTrace: A Transparent and Flexible Watermarking Scheme for Latent Diffusion Modelcited by 21
  27. 2023On Copyright Risks of Text-to-Image Diffusion Modelscited by 20
  28. 2023Exploring Incompatible Knowledge Transfer in Few-shot Image Generationcited by 19
  29. 2023A Survey on Generative Modeling with Limited Data, Few Shots, and Zero Shotcited by 19
  30. 2024Latent Watermark: Inject and Detect Watermarks in Latent Diffusion Spacecited by 19
  31. 2024UnMarker: A Universal Attack on Defensive Image Watermarkingcited by 19
  32. 2024Towards Reliable Verification of Unauthorized Data Usage in Personalized Text-to-Image Diffusion Modelscited by 19
  33. 2024Hidden in the Noise: Two-Stage Robust Watermarking for Imagescited by 18
  34. 2023Intellectual Property Protection of Diffusion Models via the Watermark Diffusion Processcited by 17
  35. 2024ProMark: Proactive Diffusion Watermarking for Causal Attributioncited by 16
  36. 2025GaussMarker: Robust Dual-Domain Watermark for Diffusion Modelscited by 16
  37. 2023On the Trustworthiness Landscape of State-of-the-art Generative Models: A Survey and Outlookcited by 15
  38. 2025Gaussian Shading++: Rethinking the Realistic Deployment Challenge of Performance-Lossless Image Watermark for Diffusion Modelscited by 12

50 most cited of 136 All 136 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2023Watermarking Diffusion Model
  2. 2025SWA-LDM: Toward Stealthy Watermarks for Latent Diffusion Models
  3. 2025Dynamic watermarks in images generated by diffusion models
  4. 2025Image Watermarking of Generative Diffusion Models
  5. 2025MarkDiffusion: An Open-Source Toolkit for Generative Watermarking of Latent Diffusion Models
  6. 2024Embedding Watermarks in Diffusion Process for Model Intellectual Property Protection
  7. 2026Editing Away the Evidence: Diffusion-Based Image Manipulation and the Failure Modes of Robust Watermarking
  8. 2024Shallow Diffuse: Robust and Invisible Watermarking through Low-Dimensional Subspaces in Diffusion Models