mlsanityData to 7 Oct 2026

An Undetectable Watermark for Generative Image Models

arXiv 2410.07369 ↗First posted 9 Oct 2024cs.CR cs.AI cs.LGcited by 74

On the map: Diffusion models → Robustness, privacy and adversarial aspects

also in 1 more
Abstract (arXiv)

We present the first undetectable watermarking scheme for generative image models. Undetectability ensures that no efficient adversary can distinguish between watermarked and un-watermarked images, even after making many adaptive queries. In particular, an undetectable watermark does not degrade image quality under any efficiently computable metric. Our scheme works by selecting the initial latents of a diffusion model using a pseudorandom error-correcting code (Christ and Gunn, 2024), a strategy which guarantees undetectability and robustness. We experimentally demonstrate that our watermarks are quality-preserving and robust using Stable Diffusion 2.1. Our experiments verify that, in contrast to every prior scheme we tested, our watermark does not degrade image quality. Our experiments also demonstrate robustness: existing watermark removal attacks fail to remove our watermark from images without significantly degrading the quality of the images. Finally, we find that we can robustly encode 512 bits in our watermark, and up to 2500 bits when the images are not subjected to watermark removal attacks. Our code is available at https://github.com/XuandongZhao/PRC-Watermark.

Key facts. Cited by 74 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 28 of its 48 references that are in the map. First posted on arXiv 9 Oct 2024.

Builds on

28 of 48 references.

Closest ancestors · 2

Same direction, newest first

  1. 2024Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models7 Apr
  2. 2023The Stable Signature: Rooting Watermarks in Latent Diffusion Models27 Mar

Other references · 26

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  3. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  4. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  5. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  6. 2020Denoising Diffusion Implicit Modelscited by 9,655
  7. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  8. 2022Flow Matching for Generative Modelingcited by 5,426
  9. 2016Improved Techniques for Training GANscited by 2,938
  10. 2022Prompt-to-Prompt Image Editing with Cross Attention Controlcited by 2,409
  11. 2022DPM-Solver: A Fast ODE Solver for Diffusion Probabilistic Model Sampling in Around 10 Stepscited by 1,961
  12. 2018Variational image compression with a scale hyperpriorcited by 910
14 more
  1. 2020Learned Image Compression with Discretized Gaussian Mixture Likelihoods and Attention Modulescited by 570
  2. 2022Inversion-Based Style Transfer with Diffusion Modelscited by 290
  3. 2019StegaStamp: Invisible Hyperlinks in Physical Photographscited by 256
  4. 2023Undetectable Watermarks for Language Modelscited by 208
  5. 2019Robust Invisible Video Watermarking with Attentioncited by 144
  6. 2023Invisible Image Watermarks Are Provably Removable Using Generative AIcited by 124
  7. 2021Watermarking Images in Self-Supervised Latent Spacescited by 90
  8. 2024WAVES: Benchmarking the Robustness of Image Watermarkscited by 89
  9. 2024RingID: Rethinking Tree-Ring Watermarking for Enhanced Multi-Key Identificationcited by 87
  10. 2023Robustness of AI-Image Detectors: Fundamental Limits and Practical Attackscited by 75
  11. 2023On Exact Inversion of DPM-Solverscited by 47
  12. 2024Pseudorandom Error-Correcting Codescited by 40
  13. 2024Edit Distance Robust Watermarks via Indexing Pseudorandom Codescited by 12
  14. 2024New constructions of pseudorandom codescited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 4; 2025: 33; 2026: 37.

74 papers.

Sort:

By area:

  1. 2024Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Modelscited by 48
  2. 2024SoK: Watermarking for AI-Generated Contentcited by 43
  3. 2025VideoShield: Regulating Diffusion-based Video Generation Models via Watermarkingcited by 32
  4. 2025SynthID-Image: Image watermarking at internet scalecited by 26
  5. 2025Frontier AI's Impact on the Cybersecurity Landscapecited by 21
  6. 2024Hidden in the Noise: Two-Stage Robust Watermarking for Imagescited by 18
  7. 2025VideoMark: A Distortion-Free Robust Watermarking Framework for Video Diffusion Modelscited by 16
  8. 2025GaussMarker: Robust Dual-Domain Watermark for Diffusion Modelscited by 16
  9. 2025SEAL: Semantic Aware Image Watermarkingcited by 13
  10. 2025Forging and Removing Latent-Noise Diffusion Watermarks Using a Single Imagecited by 12
  11. 2025T2SMark: Balancing Robustness and Diversity in Noise-as-Watermark for Diffusion Modelscited by 7
  12. 2025A Baseline Method for Removing Invisible Image Watermarks using Deep Image Priorcited by 6
38 more
  1. 2025Radioactive Watermarks in Diffusion and Autoregressive Image Generative Modelscited by 6
  2. 2025A Watermark for Auto-Regressive Image Generation Modelscited by 5
  3. 2025BitMark: Watermarking Bitwise Autoregressive Image Generative Modelscited by 5
  4. 2025MarkDiffusion: An Open-Source Toolkit for Generative Watermarking of Latent Diffusion Modelscited by 5
  5. 2025NoisePrints: Distortion-Free Watermarks for Authorship in Private Diffusion Modelscited by 5
  6. 2026SLICE: Semantic Latent Injection via Compartmentalized Embedding for Image Watermarkingcited by 5
  7. 2026Tool Use Enables Undetectable Steganography in Multi-Agent LLM Systemscited by 5
  8. 2025A Crack in the Bark: Leveraging Public Knowledge to Remove Tree-Ring Watermarkscited by 4
  9. 2025Mitigating Watermark Forgery in Generative Models via Randomized Key Selectioncited by 4
  10. 2025Secure and Robust Watermarking for AI-generated Images: A Comprehensive Surveycited by 4
  11. 2026SemBind: Binding Diffusion Watermarks to Semantics Against Black-Box Forgery Attackscited by 4
  12. 2025Towards A Correct Usage of Cryptography in Semantic Watermarks for Diffusion Modelscited by 3
  13. 2025IConMark: Robust Interpretable Concept-Based Watermark For AI Imagescited by 3
  14. 2025ClusterMark: Towards Robust Watermarking for Autoregressive Image Generators with Visual Token Clusteringcited by 3
  15. 2026Attribution as Retrieval: Model-Agnostic AI-Generated Image Attributioncited by 3
  16. 2026SHIFT: Stochastic Hidden-Trajectory Deflection for Removing Diffusion-based Watermarkcited by 3
  17. 2026TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectoriescited by 3
  18. 2025Signals of Provenance: Practices & Challenges of Navigating Indicators in AI-Generated Media for Sighted and Blind Individualscited by 2
  19. 2025OptMark: Robust Multi-bit Diffusion Watermarking via Inference Time Optimizationcited by 2
  20. 2025Provable Watermarking for Data Poisoning Attackscited by 2
  21. 2025HMARK: Radioactive Multi-Bit Semantic-Latent Watermarking for Diffusion Modelscited by 2
  22. 2025Smudged Fingerprints: A Systematic Evaluation of the Robustness of AI Image Fingerprintscited by 2
  23. 2026OSI: One-step Inversion Excels in Extracting Diffusion Watermarkscited by 2
  24. 2026Towards Robust Content Watermarking Against Removal and Forgery Attackscited by 2
  25. 2026Watermarking Should Be Treated as a Monitoring Primitivecited by 2
  26. 2024CLUE-MARK: Watermarking Diffusion Models using CLWEcited by 1
  27. 2025VIDSTAMP: A Temporally-Aware Watermark for Ownership and Integrity in Video Diffusion Modelscited by 1
  28. 2025The Coding Limits of Robust Watermarking for Generative Modelscited by 1
  29. 2025MetaSeal: Defending Against Image Attribution Forgery Through Content-Dependent Cryptographic Watermarkscited by 1
  30. 2025Low-Compute Watermark Removal via Dual-Domain Natural Projectioncited by 1
  31. 2025AuthenLoRA: Entangling Stylization with Imperceptible Watermarks for Copyright-Secure LoRA Adapterscited by 1
  32. 2025TokenPure: Watermark Removal through Tokenized Appearance and Structural Guidancecited by 1
  33. 2025Ideal Attribution and Faithful Watermarks for Language Modelscited by 1
  34. 2026Off-The-Shelf Image-to-Image Models Are All You Need To Defeat Image Protection Schemescited by 1
  35. 2026SKeDA: A Generative Watermarking Framework for Text-to-video Diffusion Modelscited by 1
  36. 2026ShapeMark: Robust and Diversity-Preserving Watermarking for Diffusion Modelscited by 1
  37. 2026On the Robustness of Watermarking for Autoregressive Image Generationcited by 1
  38. 2026Secure Seed-Based Multi-bit Watermarking for Diffusion Models from First Principlescited by 1

50 most cited of 74 All 74 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025Spread them Apart: Towards Robust Watermarking of Generated Content
  2. 2025Diffusion-Based Image Editing: An Unforeseen Adversary to Robust Invisible Watermarks
  3. 2026Vanishing Watermarks: Diffusion-Based Image Editing Undermines Robust Invisible Watermarking
  4. 2025On the Information-Theoretic Fragility of Robust Watermarking under Diffusion Editing
  5. 2024ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimization
  6. 2023A Somewhat Robust Image Watermark against Diffusion-based Editing Models
  7. 2025MaXsive: High-Capacity and Robust Training-Free Generative Image Watermarking in Diffusion Models
  8. 2026Editing Away the Evidence: Diffusion-Based Image Manipulation and the Failure Modes of Robust Watermarking