# ProMark: Proactive Diffusion Watermarking for Causal Attribution

arXiv: https://arxiv.org/abs/2403.09914 · HTML: https://mlsanity.com/paper/2403.09914/

## Key facts

- Cited by 17 papers in the map (data through 14 Oct 2026).
- Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security.
- Builds on 31 of its 39 references that are in the map.
- First posted on arXiv 14 Mar 2024.

## Placed in

- LLM safety and security / [Watermarking generated content and models](https://mlsanity.com/safety/watermarking-generated-content-and-models/)

## Builds on (most cited first, 30 of 31)

- [Learning Transferable Visual Models From Natural Language Supervision](https://mlsanity.com/paper/2103.00020/) (2021)
- [Denoising Diffusion Probabilistic Models](https://mlsanity.com/paper/2006.11239/) (2020)
- [High-Resolution Image Synthesis with Latent Diffusion Models](https://mlsanity.com/paper/2112.10752/) (2021)
- [Understanding Black-box Predictions via Influence Functions](https://mlsanity.com/paper/1703.04730/) (2017)
- [LSUN: Construction of a Large-scale Image Dataset using Deep Learning with Humans in the Loop](https://mlsanity.com/paper/1506.03365/) (2015)
- [The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks](https://mlsanity.com/paper/1802.08232/) (2018)
- [On Distillation of Guided Diffusion Models](https://mlsanity.com/paper/2210.03142/) (2022)
- [A Watermark for Large Language Models](https://mlsanity.com/paper/2301.10226/) (2023)
- [What Neural Networks Memorize and Why: Discovering the Long Tail via Influence Estimation](https://mlsanity.com/paper/2008.03703/) (2020)
- [Ablating Concepts in Text-to-Image Diffusion Models](https://mlsanity.com/paper/2303.13516/) (2023)
- [The Stable Signature: Rooting Watermarks in Latent Diffusion Models](https://mlsanity.com/paper/2303.15435/) (2023)
- [A Self-Supervised Descriptor for Image Copy Detection](https://mlsanity.com/paper/2202.10261/) (2022)
- [A Recipe for Watermarking Diffusion Models](https://mlsanity.com/paper/2303.10137/) (2023)
- [Radioactive data: tracing through training](https://mlsanity.com/paper/2002.00937/) (2020)
- [Disrupting Deepfakes: Adversarial Attacks Against Conditional Image Translation Networks and Facial Manipulation Systems](https://mlsanity.com/paper/2003.01279/) (2020)
- [Reverse Engineering of Generative Models: Inferring Model Hyperparameters from Generated Images](https://mlsanity.com/paper/2106.07873/) (2021)
- [RoSteALS: Robust Steganography using Autoencoder Latent Space](https://mlsanity.com/paper/2304.03400/) (2023)
- [FakeTagger: Robust Safeguards against DeepFake Dissemination via Provenance Tracking](https://mlsanity.com/paper/2009.09869/) (2020)
- [Evaluating Data Attribution for Text-to-Image Models](https://mlsanity.com/paper/2306.09345/) (2023)
- [BAM! The Behance Artistic Media Dataset for Recognition Beyond Photography](https://mlsanity.com/paper/1704.08614/) (2017)
- [DiffusionShield: A Watermark for Copyright Protection against Generative Diffusion Models](https://mlsanity.com/paper/2306.04642/) (2023)
- [RepMix: Representation Mixing for Robust Attribution of Synthesized Images](https://mlsanity.com/paper/2207.02063/) (2022)
- [Watermarking Diffusion Model](https://mlsanity.com/paper/2305.12502/) (2023)
- [Proactive Image Manipulation Detection](https://mlsanity.com/paper/2203.15880/) (2022)
- [ALADIN: All Layer Adaptive Instance Normalization for Fine-grained Style Similarity](https://mlsanity.com/paper/2103.09776/) (2021)
- [MaLP: Manipulation Localization Using a Proactive Scheme](https://mlsanity.com/paper/2303.16976/) (2023)
- [OSCAR-Net: Object-centric Scene Graph Attention for Image Attribution](https://mlsanity.com/paper/2108.03541/) (2021)
- [EKILA: Synthetic Media Provenance and Attribution for Generative Art](https://mlsanity.com/paper/2304.04639/) (2023)
- [Camera Trace Erasing](https://mlsanity.com/paper/2003.06951/) (2020)
- [Invisible Watermarking for Audio Generation Diffusion Models](https://mlsanity.com/paper/2309.13166/) (2023)

## Built on by (most cited first, 17 of 17)

- [OmniGuard: Hybrid Manipulation Localization via Augmented Versatile Deep Image Watermarking](https://mlsanity.com/paper/2412.01615/) (2024)
- [Semantic Watermarking Reinvented: Enhancing Robustness and Generation Quality with Fourier Integrity](https://mlsanity.com/paper/2509.07647/) (2025)
- [On the Coexistence and Ensembling of Watermarks](https://mlsanity.com/paper/2501.17356/) (2025)
- [Content ARCs: Decentralized Content Rights in the Age of Generative AI](https://mlsanity.com/paper/2503.14519/) (2025)
- [Attribution-by-design: Ensuring Inference-Time Provenance in Generative Music Systems](https://mlsanity.com/paper/2510.08062/) (2025)
- [Perturb, Attend, Detect and Localize (PADL): Robust Proactive Image Defense](https://mlsanity.com/paper/2409.17941/) (2024)
- [An Efficient Watermarking Method for Latent Diffusion Models via Low-Rank Adaptation and Dynamic Loss Weighting](https://mlsanity.com/paper/2410.20202/) (2024)
- [KGMark: A Diffusion Watermark for Knowledge Graphs](https://mlsanity.com/paper/2505.23873/) (2025)
- [Learning Probabilistic Embeddings for Unsupervised Action Segmentation](https://mlsanity.com/paper/2607.05263/) (2026)
- [MultiNeRF: Multiple Watermark Embedding for Neural Radiance Fields](https://mlsanity.com/paper/2504.02517/) (2025)
- [Protecting Your Voice: Temporal-aware Robust Watermarking](https://mlsanity.com/paper/2504.14832/) (2025)
- [TriniMark: A Robust Generative Speech Watermarking Method for Trinity-Level Traceability](https://mlsanity.com/paper/2504.20532/) (2025)
- [TokenTrace: Multi-Concept Attribution through Watermarked Token Recovery](https://mlsanity.com/paper/2602.19019/) (2026)
- [Splats in Splats++: Robust and Generalizable 3D Gaussian Splatting Steganography](https://mlsanity.com/paper/2604.15862/) (2026)
- [Membership is Ownership: A Robust Ownership Verification Framework for Diffusion Models](https://mlsanity.com/paper/2608.28929/) (2026)
- [FeatMark: Feature-level Watermark Protection against Mimicry Attacks with Diffusion Models](https://mlsanity.com/paper/2609.30980/) (2026)
- [Disentangle and Drop: Robust Universal Removal of Image Watermarks via Reconstructive Grayscale Residual Decomposition](https://mlsanity.com/paper/2609.31693/) (2026)

## Abstract (arXiv)

Generative AI (GenAI) is transforming creative workflows through the capability to synthesize and manipulate images via high-level prompts. Yet creatives are not well supported to receive recognition or reward for the use of their content in GenAI training. To this end, we propose ProMark, a causal attribution technique to attribute a synthetically generated image to its training data concepts like objects, motifs, templates, artists, or styles. The concept information is proactively embedded into the input training images using imperceptible watermarks, and the diffusion models (unconditional or conditional) are trained to retain the corresponding watermarks in generated images. We show that we can embed as many as 216 unique watermarks into the training data, and each training image can contain more than one watermark. ProMark can maintain image quality whilst outperforming correlation-based attribution. Finally, several qualitative examples are presented, providing the confidence that the presence of the watermark conveys a causative relationship between training data and synthetic images.