# Attack-Resilient Image Watermarking Using Stable Diffusion

arXiv: https://arxiv.org/abs/2401.04247 · HTML: https://mlsanity.com/paper/2401.04247/

## Key facts

- Cited by 35 papers in the map (data through 14 Oct 2026).
- Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models.
- Builds on 23 of its 54 references that are in the map.
- First posted on arXiv 8 Jan 2024.

## Placed in

- Diffusion models / [Robustness, privacy and adversarial aspects](https://mlsanity.com/diffusion/robustness-privacy-and-adversarial-aspects/)
- LLM safety and security / [Watermarking generated content and models](https://mlsanity.com/safety/watermarking-generated-content-and-models/)

## Builds on (most cited first, 23 of 23)

- [High-Resolution Image Synthesis with Latent Diffusion Models](https://mlsanity.com/paper/2112.10752/) (2021)
- [Microsoft COCO: Common Objects in Context](https://mlsanity.com/paper/1405.0312/) (2014)
- [The Unreasonable Effectiveness of Deep Features as a Perceptual Metric](https://mlsanity.com/paper/1801.03924/) (2018)
- [Denoising Diffusion Implicit Models](https://mlsanity.com/paper/2010.02502/) (2020)
- [Diffusion Models Beat GANs on Image Synthesis](https://mlsanity.com/paper/2105.05233/) (2021)
- [Deep Unsupervised Learning using Nonequilibrium Thermodynamics](https://mlsanity.com/paper/1503.03585/) (2015)
- [Hierarchical Text-Conditional Image Generation with CLIP Latents](https://mlsanity.com/paper/2204.06125/) (2022)
- [Photorealistic Text-to-Image Diffusion Models with Deep Language Understanding](https://mlsanity.com/paper/2205.11487/) (2022)
- [Beyond a Gaussian Denoiser: Residual Learning of Deep CNN for Image Denoising](https://mlsanity.com/paper/1608.03981/) (2016)
- [Variational image compression with a scale hyperprior](https://mlsanity.com/paper/1802.01436/) (2018)
- [Learned Image Compression with Discretized Gaussian Mixture Likelihoods and Attention Modules](https://mlsanity.com/paper/2001.01568/) (2020)
- [HiDDeN: Hiding Data With Deep Networks](https://mlsanity.com/paper/1807.09937/) (2018)
- [DiffusionDB: A Large-scale Prompt Gallery Dataset for Text-to-Image Generative Models](https://mlsanity.com/paper/2210.14896/) (2022)
- [The Stable Signature: Rooting Watermarks in Latent Diffusion Models](https://mlsanity.com/paper/2303.15435/) (2023)
- [StegaStamp: Invisible Hyperlinks in Physical Photographs](https://mlsanity.com/paper/1904.05343/) (2019)
- [Robust Invisible Video Watermarking with Attention](https://mlsanity.com/paper/1909.01285/) (2019)
- [A Recipe for Watermarking Diffusion Models](https://mlsanity.com/paper/2303.10137/) (2023)
- [Watermarking Images in Self-Supervised Latent Spaces](https://mlsanity.com/paper/2112.09581/) (2021)
- [Distortion Agnostic Deep Watermarking](https://mlsanity.com/paper/2001.04580/) (2020)
- [SteganoGAN: High Capacity Image Steganography with GANs](https://mlsanity.com/paper/1901.03892/) (2019)
- [Towards Blind Watermarking: Combining Invertible and Non-invertible Mechanisms](https://mlsanity.com/paper/2212.12678/) (2022)
- [A Loss Function for Generative Neural Networks Based on Watson's Perceptual Model](https://mlsanity.com/paper/2006.15057/) (2020)
- [Securing Deep Generative Models with Universal Adversarial Signature](https://mlsanity.com/paper/2305.16310/) (2023)

## Built on by (most cited first, 30 of 35)

- [Detecting Multimedia Generated by Large AI Models: A Survey](https://mlsanity.com/paper/2402.00045/) (2024)
- [LaWa: Using Latent Space for In-Generation Image Watermarking](https://mlsanity.com/paper/2408.05868/) (2024)
- [Semantic Watermarking Reinvented: Enhancing Robustness and Generation Quality with Fourier Integrity](https://mlsanity.com/paper/2509.07647/) (2025)
- [Mask Image Watermarking](https://mlsanity.com/paper/2504.12739/) (2025)
- [MarkPlugger: Generalizable Watermark Framework for Latent Diffusion Models without Retraining](https://mlsanity.com/paper/2404.05607/) (2024)
- [Secure and Robust Watermarking for AI-generated Images: A Comprehensive Survey](https://mlsanity.com/paper/2510.02384/) (2025)
- [The Brittleness of AI-Generated Image Watermarking Techniques: Examining Their Robustness Against Visual Paraphrasing Attacks](https://mlsanity.com/paper/2408.10446/) (2024)
- [Towards Robust Content Watermarking Against Removal and Forgery Attacks](https://mlsanity.com/paper/2604.06662/) (2026)
- [PT-Mark: Invisible Watermarking for Text-to-image Diffusion Models via Semantic-aware Pivotal Tuning](https://mlsanity.com/paper/2504.10853/) (2025)
- [OptMark: Robust Multi-bit Diffusion Watermarking via Inference Time Optimization](https://mlsanity.com/paper/2508.21727/) (2025)
- [OSI: One-step Inversion Excels in Extracting Diffusion Watermarks](https://mlsanity.com/paper/2602.09494/) (2026)
- [Adversarial Attacks for Good: A Survey of Proactive Protection across the Visual Content Lifecycle](https://mlsanity.com/paper/2608.04314/) (2026)
- [KGMark: A Diffusion Watermark for Knowledge Graphs](https://mlsanity.com/paper/2505.23873/) (2025)
- [Low-Compute Watermark Removal via Dual-Domain Natural Projection](https://mlsanity.com/paper/2510.07538/) (2025)
- [Robust Spectral Watermark for Synthetic Tabular Data](https://mlsanity.com/paper/2511.21600/) (2025)
- [PhaseMark: A Post-hoc, Optimization-Free Watermarking of AI-generated Images in the Latent Frequency Domain](https://mlsanity.com/paper/2601.13128/) (2026)
- [Off-The-Shelf Image-to-Image Models Are All You Need To Defeat Image Protection Schemes](https://mlsanity.com/paper/2602.22197/) (2026)
- [Latent-Mark: An Audio Watermark Robust to Neural Codec Compression](https://mlsanity.com/paper/2603.05310/) (2026)
- [ShapeMark: Robust and Diversity-Preserving Watermarking for Diffusion Models](https://mlsanity.com/paper/2603.09454/) (2026)
- [Removing the Watermark Is Not Enough: Forensic Stealth in Generative-AI Watermark Removal](https://mlsanity.com/paper/2605.09203/) (2026)
- [Are Watermarked Images Editable? SafeMark for Watermark-Preserving Text-Guided Image Editing](https://mlsanity.com/paper/2605.19511/) (2026)
- [LoRA-Key: User-Centric LoRA Watermarking for Text-to-Image Diffusion Models](https://mlsanity.com/paper/2605.29569/) (2026)
- [PALADIN : Robust Neural Fingerprinting for Text-to-Image Diffusion Models](https://mlsanity.com/paper/2506.03170/) (2025)
- [UniMark: Artificial Intelligence Generated Content Identification Toolkit](https://mlsanity.com/paper/2512.12324/) (2025)
- [Where is the Watermark? Interpretable Watermark Detection at the Block Level](https://mlsanity.com/paper/2512.14994/) (2025)
- [ALIEN: Analytic Latent Watermarking for Controllable Generation](https://mlsanity.com/paper/2602.06101/) (2026)
- [When Denoising Becomes Unsigning: Theoretical and Empirical Analysis of Watermark Fragility Under Diffusion-Based Image Editing](https://mlsanity.com/paper/2603.04696/) (2026)
- [Watermarks Attack Watermarks: Re-Watermarking as a Generic Removal Strategy](https://mlsanity.com/paper/2605.16796/) (2026)
- [Position: AI/ML Deepfake Research is Misaligned with AI-Generated Non-Consensual Intimate Imagery (AIG-NCII)](https://mlsanity.com/paper/2607.18263/) (2026)
- [SpreadMark: Robust Image Watermarking via Spread-Spectrum Embedding](https://mlsanity.com/paper/2608.03165/) (2026)

## Abstract (arXiv)

Watermarking images is critical for tracking image provenance and proving ownership. With the advent of generative models, such as stable diffusion, that can create fake but realistic images, watermarking has become particularly important to make human-created images reliably identifiable. Unfortunately, the very same stable diffusion technology can remove watermarks injected using existing methods. To address this problem, we present ZoDiac, which uses a pre-trained stable diffusion model to inject a watermark into the trainable latent space, resulting in watermarks that can be reliably detected in the latent vector even when attacked. We evaluate ZoDiac on three benchmarks, MS-COCO, DiffusionDB, and WikiArt, and find that ZoDiac is robust against state-of-the-art watermark attacks, with a watermark detection rate above 98% and a false positive rate below 6.4%, outperforming state-of-the-art watermarking methods. We hypothesize that the reciprocating denoising process in diffusion models may inherently enhance the robustness of the watermark when faced with strong attacks and validate the hypothesis. Our research demonstrates that stable diffusion is a promising approach to robust watermarking, able to withstand even stable-diffusion--based attack methods. ZoDiac is open-sourced and available at https://github.com/zhanglijun95/ZoDiac.