# LaWa: Using Latent Space for In-Generation Image Watermarking

arXiv: https://arxiv.org/abs/2408.05868 · HTML: https://mlsanity.com/paper/2408.05868/

## Key facts

- Cited by 28 papers in the map (data through 14 Oct 2026).
- Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security.
- Builds on 48 of its 75 references that are in the map.
- First posted on arXiv 11 Aug 2024.

## Placed in

- LLM safety and security / [Watermarking generated content and models](https://mlsanity.com/safety/watermarking-generated-content-and-models/)

## Builds on (most cited first, 30 of 48)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Language Models are Few-Shot Learners](https://mlsanity.com/paper/2005.14165/) (2020)
- [High-Resolution Image Synthesis with Latent Diffusion Models](https://mlsanity.com/paper/2112.10752/) (2021)
- [Microsoft COCO: Common Objects in Context](https://mlsanity.com/paper/1405.0312/) (2014)
- [LLaMA: Open and Efficient Foundation Language Models](https://mlsanity.com/paper/2302.13971/) (2023)
- [The Unreasonable Effectiveness of Deep Features as a Perceptual Metric](https://mlsanity.com/paper/1801.03924/) (2018)
- [Hierarchical Text-Conditional Image Generation with CLIP Latents](https://mlsanity.com/paper/2204.06125/) (2022)
- [Photorealistic Text-to-Image Diffusion Models with Deep Language Understanding](https://mlsanity.com/paper/2205.11487/) (2022)
- [Adding Conditional Control to Text-to-Image Diffusion Models](https://mlsanity.com/paper/2302.05543/) (2023)
- [PaLM: Scaling Language Modeling with Pathways](https://mlsanity.com/paper/2204.02311/) (2022)
- [Improved Denoising Diffusion Probabilistic Models](https://mlsanity.com/paper/2102.09672/) (2021)
- [GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Models](https://mlsanity.com/paper/2112.10741/) (2021)
- [Taming Transformers for High-Resolution Image Synthesis](https://mlsanity.com/paper/2012.09841/) (2020)
- [DreamFusion: Text-to-3D using 2D Diffusion](https://mlsanity.com/paper/2209.14988/) (2022)
- [Prompt-to-Prompt Image Editing with Cross Attention Control](https://mlsanity.com/paper/2208.01626/) (2022)
- [Imagen Video: High Definition Video Generation with Diffusion Models](https://mlsanity.com/paper/2210.02303/) (2022)
- [Make-A-Video: Text-to-Video Generation without Text-Video Data](https://mlsanity.com/paper/2209.14792/) (2022)
- [Magic3D: High-Resolution Text-to-3D Content Creation](https://mlsanity.com/paper/2211.10440/) (2022)
- [Null-text Inversion for Editing Real Images using Guided Diffusion Models](https://mlsanity.com/paper/2211.09794/) (2022)
- [Variational image compression with a scale hyperprior](https://mlsanity.com/paper/1802.01436/) (2018)
- [Vector Quantized Diffusion Model for Text-to-Image Synthesis](https://mlsanity.com/paper/2111.14822/) (2021)
- [Resolution-robust Large Mask Inpainting with Fourier Convolutions](https://mlsanity.com/paper/2109.07161/) (2021)
- [DiffEdit: Diffusion-based semantic image editing with mask guidance](https://mlsanity.com/paper/2210.11427/) (2022)
- [Wasserstein GAN](https://mlsanity.com/paper/1701.07875/) (2017)
- [Learned Image Compression with Discretized Gaussian Mixture Likelihoods and Attention Modules](https://mlsanity.com/paper/2001.01568/) (2020)
- [Leveraging Frequency Analysis for Deep Fake Image Recognition](https://mlsanity.com/paper/2003.08685/) (2020)
- [HiDDeN: Hiding Data With Deep Networks](https://mlsanity.com/paper/1807.09937/) (2018)
- [SinGAN: Learning a Generative Model from a Single Natural Image](https://mlsanity.com/paper/1905.01164/) (2019)
- [Exposing DeepFake Videos By Detecting Face Warping Artifacts](https://mlsanity.com/paper/1811.00656/) (2018)
- [The Stable Signature: Rooting Watermarks in Latent Diffusion Models](https://mlsanity.com/paper/2303.15435/) (2023)

## Built on by (most cited first, 28 of 28)

- [Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advances](https://mlsanity.com/paper/2410.18775/) (2024)
- [Watermark Anything with Localized Messages](https://mlsanity.com/paper/2411.07231/) (2024)
- [Image Watermarks are Removable Using Controllable Regeneration from Clean Noise](https://mlsanity.com/paper/2410.05470/) (2024)
- [SleeperMark: Towards Robust Watermark against Fine-Tuning Text-to-image Diffusion Models](https://mlsanity.com/paper/2412.04852/) (2024)
- [GaussMarker: Robust Dual-Domain Watermark for Diffusion Models](https://mlsanity.com/paper/2506.11444/) (2025)
- [Semantic Watermarking Reinvented: Enhancing Robustness and Generation Quality with Fourier Integrity](https://mlsanity.com/paper/2509.07647/) (2025)
- [Survey on AI-Generated Media Detection: From Non-MLLM to MLLM](https://mlsanity.com/paper/2502.05240/) (2025)
- [LVMark: Robust Watermark for Latent Video Diffusion Models](https://mlsanity.com/paper/2412.09122/) (2024)
- [Video Signature: Implicit Watermarking for Video Diffusion Models](https://mlsanity.com/paper/2506.00652/) (2025)
- [GaussianSeal: Rooting Adaptive Watermarks for 3D Gaussian Generation Model](https://mlsanity.com/paper/2503.00531/) (2025)
- [Learning to Watermark in the Latent Space of Generative Models](https://mlsanity.com/paper/2601.16140/) (2026)
- [Just Noticeable Difference Modeling for Deep Visual Features](https://mlsanity.com/paper/2601.21933/) (2026)
- [Attribution as Retrieval: Model-Agnostic AI-Generated Image Attribution](https://mlsanity.com/paper/2603.10583/) (2026)
- [Towards Secure and Usable 3D Assets: A Novel Framework for Automatic Visible Watermarking](https://mlsanity.com/paper/2409.00314/) (2024)
- [An Efficient Watermarking Method for Latent Diffusion Models via Low-Rank Adaptation and Dynamic Loss Weighting](https://mlsanity.com/paper/2410.20202/) (2024)
- [Your Text Encoder Can Be An Object-Level Watermarking Controller](https://mlsanity.com/paper/2503.11945/) (2025)
- [VocBulwark: Towards Practical Generative Speech Watermarking via Additional-Parameter Injection](https://mlsanity.com/paper/2601.22556/) (2026)
- [Are Watermarked Images Editable? SafeMark for Watermark-Preserving Text-Guided Image Editing](https://mlsanity.com/paper/2605.19511/) (2026)
- [COVER: Codec-Robust Video Watermarking with Generative Video Priors](https://mlsanity.com/paper/2609.26236/) (2026)
- [MOLM: Mixture of LoRA Markers](https://mlsanity.com/paper/2510.00293/) (2025)
- [Foveation Improves Payload Capacity in Steganography](https://mlsanity.com/paper/2510.13151/) (2025)
- [ALIEN: Analytic Latent Watermarking for Controllable Generation](https://mlsanity.com/paper/2602.06101/) (2026)
- [TokenTrace: Multi-Concept Attribution through Watermarked Token Recovery](https://mlsanity.com/paper/2602.19019/) (2026)
- [Watermarks Attack Watermarks: Re-Watermarking as a Generic Removal Strategy](https://mlsanity.com/paper/2605.16796/) (2026)
- [BiSLW: Bi-Spectral Latent Watermarking for Generative Diffusion Models](https://mlsanity.com/paper/2607.02643/) (2026)
- [Reviewing Model Collapse and Countermeasures](https://mlsanity.com/paper/2608.21366/) (2026)
- [On the Information-Theoretic Limits of Latent-Space Watermarking Through Pretrained Generators](https://mlsanity.com/paper/2609.24377/) (2026)
- [Trustworthy synthetic visual media: Evidence across the media lifecycle](https://mlsanity.com/paper/2609.34232/) (2026)

## Abstract (arXiv)

With generative models producing high quality images that are indistinguishable from real ones, there is growing concern regarding the malicious usage of AI-generated images. Imperceptible image watermarking is one viable solution towards such concerns. Prior watermarking methods map the image to a latent space for adding the watermark. Moreover, Latent Diffusion Models (LDM) generate the image in the latent space of a pre-trained autoencoder. We argue that this latent space can be used to integrate watermarking into the generation process. To this end, we present LaWa, an in-generation image watermarking method designed for LDMs. By using coarse-to-fine watermark embedding modules, LaWa modifies the latent space of pre-trained autoencoders and achieves high robustness against a wide range of image transformations while preserving perceptual quality of the image. We show that LaWa can also be used as a general image watermarking method. Through extensive experiments, we demonstrate that LaWa outperforms previous works in perceptual quality, robustness against attacks, and computational complexity, while having very low false positive rate. Code is available here.