mlsanityData to 7 Oct 2026

Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust

arXiv 2305.20030 ↗First posted 31 May 2023cs.LG cs.CR cs.CVcited by 179

On the map: Diffusion models → Robustness, privacy and adversarial aspects

also in 1 more
Abstract (arXiv)

Watermarking the outputs of generative models is a crucial technique for tracing copyright and preventing potential harm from AI-generated content. In this paper, we introduce a novel technique called Tree-Ring Watermarking that robustly fingerprints diffusion model outputs. Unlike existing methods that perform post-hoc modifications to images after sampling, Tree-Ring Watermarking subtly influences the entire sampling process, resulting in a model fingerprint that is invisible to humans. The watermark embeds a pattern into the initial noise vector used for sampling. These patterns are structured in Fourier space so that they are invariant to convolutions, crops, dilations, flips, and rotations. After image generation, the watermark signal is detected by inverting the diffusion process to retrieve the noise vector, which is then checked for the embedded signal. We demonstrate that this technique can be easily applied to arbitrary diffusion models, including text-conditioned Stable Diffusion, as a plug-in with negligible loss in FID. Our watermark is semantically hidden in the image space and is far more robust than watermarking alternatives that are currently deployed. Code is available at https://github.com/YuxinWenRick/tree-ring-watermark.

Key facts. Cited by 179 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 22 of its 42 references that are in the map. First posted on arXiv 31 May 2023.

Builds on

22 of 42 references.

Closest ancestors · 2

Same direction, newest first

  1. 2023The Stable Signature: Rooting Watermarks in Latent Diffusion Models27 Mar
  2. 2023A Recipe for Watermarking Diffusion Models17 Mar

Other references · 20

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  2. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  3. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  4. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  5. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  6. 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,067
  7. 2021Improved Denoising Diffusion Probabilistic Modelscited by 3,736
  8. 2022Reproducible scaling laws for contrastive language-image learningcited by 1,163
  9. 2020Improved Techniques for Training Score-Based Generative Modelscited by 1,036
  10. 2023A Watermark for Large Language Modelscited by 667
  11. 2018HiDDeN: Hiding Data With Deep Networkscited by 384
  12. 2022EDICT: Exact Diffusion Inversion via Coupled Transformationscited by 256
8 more
  1. 2017Embedding Watermarks into Deep Neural Networkscited by 227
  2. 2020Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution in Training Datacited by 200
  3. 2019Robust Invisible Video Watermarking with Attentioncited by 144
  4. 2017Generating Steganographic Images via Adversarial Trainingcited by 57
  5. 2022Certified Neural Network Watermarks with Randomized Smoothingcited by 39
  6. 2022Supervised GAN Watermarking for Intellectual Property Protectioncited by 39
  7. 2022The Ethical Need for Watermarks in Machine-Generated Languagecited by 30
  8. 2023Securing Deep Generative Models with Universal Adversarial Signaturecited by 13

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 20; 2024: 47; 2025: 59; 2026: 53.

179 papers.

Sort:

By area:

  1. 2023Self-Consuming Generative Models Go MADcited by 239
  2. 2024Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Modelscited by 131
  3. 2023Invisible Image Watermarks Are Provably Removable Using Generative AIcited by 124
  4. 2023EditGuard: Versatile Image Watermarking for Tamper Localization and Copyright Protectioncited by 109
  5. 2024Improving the Training of Rectified Flowscited by 106
  6. 2024Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advancescited by 105
  7. 2024Detecting, Explaining, and Mitigating Memorization in Diffusion Modelscited by 94
  8. 2024WAVES: Benchmarking the Robustness of Image Watermarkscited by 89
  9. 2024RingID: Rethinking Tree-Ring Watermarking for Enhanced Multi-Key Identificationcited by 87
  10. 2023Three Bricks to Consolidate Watermarks for Large Language Modelscited by 80
  11. 2023Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Modelscited by 77
  12. 2023Robustness of AI-Image Detectors: Fundamental Limits and Practical Attackscited by 75
38 more
  1. 2024Detecting Multimedia Generated by Large AI Models: A Surveycited by 73
  2. 2023A Survey on Detection of LLMs-Generated Contentcited by 70
  3. 2024Proactive Detection of Voice Cloning with Localized Watermarkingcited by 67
  4. 2024R.A.C.E.: Robust Adversarial Concept Erasure for Secure Text-to-Image Diffusion Modelcited by 56
  5. 2023WOUAF: Weight Modulation for User Attribution and Fingerprinting in Text-to-Image Diffusion Modelscited by 51
  6. 2023Leveraging Optimization for Adaptive Attacks on Image Watermarkscited by 50
  7. 2024Watermark Anything with Localized Messagescited by 49
  8. 2023On Exact Inversion of DPM-Solverscited by 47
  9. 2024No Free Lunch in LLM Watermarking: Trade-offs in Watermarking Design Choicescited by 47
  10. 2024ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimizationcited by 45
  11. 2024Video Seal: Open and Efficient Video Watermarkingcited by 45
  12. 2024SoK: Watermarking for AI-Generated Contentcited by 43
  13. 2024AquaLoRA: Toward White-box Protection for Customized Stable Diffusion Models via Watermark LoRAcited by 42
  14. 2024Copyright Protection in Generative AI: A Technical Perspectivecited by 35
  15. 2024A Watermark-Conditioned Diffusion Model for IP Protectioncited by 34
  16. 2024WMAdapter: Adding WaterMark Control to Latent Diffusion Modelscited by 29
  17. 2024Conditional Image Synthesis with Diffusion Models: A Surveycited by 29
  18. 2024LaWa: Using Latent Space for In-Generation Image Watermarkingcited by 27
  19. 2025SynthID-Image: Image watermarking at internet scalecited by 26
  20. 2024How to Trace Latent Generative Model Generated Images without Artificial Watermark?cited by 25
  21. 2024DiffuseTrace: A Transparent and Flexible Watermarking Scheme for Latent Diffusion Modelcited by 21
  22. 2023A Survey on Generative Modeling with Limited Data, Few Shots, and Zero Shotcited by 19
  23. 2024Latent Watermark: Inject and Detect Watermarks in Latent Diffusion Spacecited by 19
  24. 2024Hidden in the Noise: Two-Stage Robust Watermarking for Imagescited by 18
  25. 2024Stable Signature is Unstable: Removing Image Watermark from Diffusion Modelscited by 16
  26. 2025VideoMark: A Distortion-Free Robust Watermarking Framework for Video Diffusion Modelscited by 16
  27. 2023On the Trustworthiness Landscape of State-of-the-art Generative Models: A Survey and Outlookcited by 15
  28. 2025Watermarking Autoregressive Image Generationcited by 15
  29. 2025Pixel Seal: Adversarial-only training for invisible image and video watermarkingcited by 14
  30. 2025SEAL: Semantic Aware Image Watermarkingcited by 13
  31. 2024A Survey of Defenses Against AI-Generated Visual Media: Detection,Disruption, and Authenticationcited by 12
  32. 2025Gaussian Shading++: Rethinking the Realistic Deployment Challenge of Performance-Lossless Image Watermark for Diffusion Modelscited by 12
  33. 2025Forging and Removing Latent-Noise Diffusion Watermarks Using a Single Imagecited by 12
  34. 2024Concept Arithmetics for Circumventing Concept Inhibition in Diffusion Modelscited by 11
  35. 2024Steganalysis on Digital Watermarking: Is Your Defense Truly Impervious?cited by 10
  36. 2025LatexBlend: Scaling Multi-concept Customized Generation with Latent Textual Blendingcited by 10
  37. 2024Iteratively Prompting Multimodal LLMs to Reproduce Natural and AI-Generated Imagescited by 9
  38. 2024JIGMARK: A Black-Box Approach for Enhancing Image Watermarks against Diffusion Model Editscited by 9

50 most cited of 179 All 179 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025A Crack in the Bark: Leveraging Public Knowledge to Remove Tree-Ring Watermarks
  2. 2026Forging Tree-Ring: Reproducing and Instrumenting Black-Box Semantic Watermark Forgery
  3. 2025SWA-LDM: Toward Stealthy Watermarks for Latent Diffusion Models
  4. 2025MaXsive: High-Capacity and Robust Training-Free Generative Image Watermarking in Diffusion Models
  5. 2024Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models
  6. 2024Exploiting Watermark-Based Defense Mechanisms in Text-to-Image Diffusion Models for Unauthorized Data Usage
  7. 2025Harnessing Frequency Spectrum Insights for Image Copyright Protection Against Diffusion Models
  8. 2024Shallow Diffuse: Robust and Invisible Watermarking through Low-Dimensional Subspaces in Diffusion Models